2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"product":"DICOM Server","vendor":"Orthanc","versions":[{"lessThanOrEqual":"1.12.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*","matchCriteriaId":"A259075D-8B77-4B04-BC42-3E5ABE9DFE1F","versionEndExcluding":"1.12.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images. Pixel length validation uses 32-bit multiplication for width and height calculations. If these values overflow, the validation check incorrectly succeeds, allowing the decoder to read and write to memory beyond allocated buffers."},{"lang":"es","value":"Existe una vulnerabilidad de desbordamiento de búfer en el heap durante la decodificación de imágenes DICOM ’PALETTE COLOR’. La validación de la longitud de píxeles utiliza multiplicación de 32 bits para los cálculos de ancho y alto. Si estos valores se desbordan, la comprobación de validación tiene éxito de forma incorrecta, lo que permite al decodificador leer y escribir en la memoria más allá de los búferes asignados."}],"id":"CVE-2026-5443","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5443","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-14T15:10:56.990073Z","version":"2.0.3"}}]},"published":"2026-04-09T15:16:16.653","references":[{"source":"cret@cert.org","tags":["Third Party Advisory","VDB Entry"],"url":"https://kb.cert.org/vuls/id/536588"},{"source":"cret@cert.org","tags":["Not Applicable"],"url":"https://www.machinespirits.de/"},{"source":"cret@cert.org","tags":["Product"],"url":"https://www.orthanc-server.com/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
|