An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20193-1 advisory.

    Changes in orthanc:

    - dcmtk 370 breaks TW build

    - switch to lua 5.4

    - patch out boost component system from framework

    - version 1.12.10       ' long changelog - see NEWS for details

    - apply boost patch to source tree

    - Stop trying to pull libboost_system-devel in all orthanc packages.

    - remove libboost_system-devel for TW (removed in boost 1.89)

    - version 1.12.9
      * long changelog - see NEWS for details

    Changes in gdcm:

    - apply fix for poppler 25.10 build error

    Changes in orthanc-authorization:

    - version 0.10.3
      * New default permissions for worklists
      * New default permissions for tools/metrics-prometheus
      * New default permissions for tools/generate-uid

    - version 0.10.2
      * New default permissions to add/delete modalities through the Rest API         https://discourse.orthanc-server.org/t/managing-modalities-using-the-rest-api-and-keycloak/6137
      * New standard configuration stl

    - remove libboost_system-devel for TW (removed in boost 1.89)-

    - version 0.10.1
      * Fix audit-logs export in CSV format.
      * New configuration ExtraPermissions to ADD new permissions to         the default Permissions entries.
      * Improved handling of Anonymous user profiles (when no auth-tokens         are provided):  The plugin will now request the auth-service to         get an anonymous user profile even if there are no auth-tokens in the         HTTP request.
      * The User profile can now contain a groups field if the auth-service         provides it.
      * The User profile can now contain an id field if the auth-service         provides it.
      * New experimental feature: audit-logs
        - Enabled by the EnableAuditLogs configuration.
        - Audit-logs are currently handled by the PostgreSQL plugin and can be           browsed through the route /auth/audit-logs.
        - New default permission audit-logs to grant access to the           /auth/audit-logs route.
      * Fix: The server-id field is now included in all requests sent to the         auth-service.

    Changes in orthanc-dicomweb:

    - version 1.22
      * framework2.diff added for compatibilty with Orthanc framework <= 1.12.10
      * Fixed a possible deadlock when using WadoRsLoaderThreadsCount > 1 when the HTTP         client disconnects while downloading the response.
      * Fixed Success: Success errors when trying to send resources synchronously to a remote DICOMweb         server while the Orthanc job engine was busy with other tasks.

    - remove libboost_system-devel for TW (removed in boost 1.89)

    - version 1.21
      * New configuration WadoRsLoaderThreadsCount to configure how many threads are loading         files from the storage when answering to a WADO-RS query.  A value > 1 is meaningful         only if the storage is a distributed network storage (e.g object storage plugin).
        A value of 0 means reading and writing are performed in sequence (default behaviour).
      * New configuration EnablePerformanceLogs to display performance logs.  Currently         only showing the time required to execute a WADO-RS query.  For example:
        WADO-RS: elapsed: 26106623 us, rate: 14.86 instances/s, 155.23Mbps
      * Fix false errors logs generated e.g when OHIF requests the /dicom-web/studies/../metadata route:
        dicom-web:/Configuration.cpp:643] Unsupported return MIME type: application/dicom+json,     multipart/related; type=application/octet-stream; transfer-syntax=*, will return DICOM+JSON

    Changes in orthanc-gdcm:

    - version 1.8
      * Prevent transcoding of DICOM images with empty         SharedFunctionalGroupsSequence (5200,9229), as this might crash GDCM.
      * The built-in Orthanc transcoder being usually more stable, the default         value of the RestrictTransferSyntaxes configuration has been updated         to configure the GDCM plugin for J2K transfer syntaxes only since these         transfer syntaxes are currently not supported by the built-in Orthanc         transcoder.
        - If RestrictTransferSyntaxes is not specified in your configuration,           it is now equivalent to             RestrictTransferSyntaxes : [               1.2.840.10008.1.2.4.90,   // JPEG 2000 Image Compression (Lossless Only)               1.2.840.10008.1.2.4.91,   // JPEG 2000 Image Compression               1.2.840.10008.1.2.4.92,   // JPEG 2000 Part 2 Multicomponent Image Compression (Lossless Only)               1.2.840.10008.1.2.4.93    // JPEG 2000 Part 2 Multicomponent Image Compression             ]           which was the recommended configuration.
        - If RestrictTransferSyntaxes is defined but empty, the GDCM plugin will           now be used to transcode ALL transfer syntaxes (this was the default           behaviour up to version 1.7)

    - remove libboost_system-devel for TW (removed in boost 1.89)

    - version 1.7
      * Upgrade to GDCM 3.0.24 for static builds. Fixes:
        - CVE-2024-22373: https://nvd.nist.gov/vuln/detail/CVE-2024-22373
        - CVE-2024-22391: https://nvd.nist.gov/vuln/detail/CVE-2024-22391
        - CVE-2024-25569: https://nvd.nist.gov/vuln/detail/CVE-2024-25569

    Changes in orthanc-indexer:

    - remove libboost_system-devel for TW (removed in boost 1.89)

    Changes in orthanc-mysql:

    - remove libboost_system-devel for TW (removed in boost 1.89)

    Changes in orthanc-neuro:

    - remove libboost_system-devel for TW (removed in boost 1.89)

    Changes in orthanc-postgresql:

    - version 10.0
      * update mainly providing new Reserve and Acknowledge primitives         for Queues in plugins

    - remove libboost_system-devel for TW (removed in boost 1.89)

    - version 9.0
      * DB-scheme rev. 6 - check Orthanc book

    - version 8.0
      * no changelog provided
      * New DB scheme

    Changes in orthanc-python:

    - version 7.0
      * The orthanc.pyi stub is now excluded from the install step during the build
      * Wrapped new SCP callbacks:
        - RegisterFindCallback2()
        - RegisterMoveCallback3()
        - RegisterWorklistCallback2()
        - RegisterStorageCommitmentScpCallback2()
      * Wrapped new Queues methods:
        - ReserveQueueValue()
        - AcknowledgeQueueValue()

    - remove libboost_system-devel for TW (removed in boost 1.89)

    - remove /usr/orthanc.pyi - unneeded

    - version 6.0
      * The auto-generation of the Python wrapper is now part of the build,         to exploit the ORTHANC_PLUGIN_SINCE_SDK macro. This provides backward         compatibility with the SDK that is actually installed on the system
      * Added Windows builder for Python 3.13
      * Added Docker-based builder scripts for Debian 13 (trixie)

    Changes in orthanc-stl:

    - patch out libboost-system to fix build error

    - remove libboost_system-devel for TW (removed in boost 1.89)

    Changes in orthanc-tcia:

    - version 1.3
      * Replaced default base URL of TCIA REST API from         https://services.cancerimagingarchive.net/services/v4/TCIA/query to         https://nbia.cancerimagingarchive.net/nbia-api/services/v4
      * Added configuration option BaseUrl to manually configure the base URL
      * Fix for newer versions of the NBIA cart file format
      * Upgrade to Orthanc framework 1.12.3

    - remove libboost_system-devel for TW (removed in boost 1.89)

    Changes in orthanc-wsi:

    - fix build error w framework 1.12.10

    - version 3.3
      * OrthancWSIDicomizer:
        - New option --encoding to specify the specific character set of DICOM instances
        - Placeholder tags are now automatically inserted when the --dataset option           provides incomplete data, ensuring the generated DICOM instances remain valid
        - The version of the DICOM-izer is available in DICOM tag SoftwareVersions
        - ImagedVolumeWidth and ImagedVolumeHeight are swapped with respect to releases <= 3.2:
          https://discourse.orthanc-server.org/t/5912
      * Viewer plugin:
        - Added rotation button in the viewer
        - The viewer displays a label if the description GET parameter is provided
        - Upgraded to OpenLayers 10.6.1

    - remove libboost_system-devel for TW (removed in boost 1.89)

    Changes in python-pyorthanc:

    - version 1.22.1
      * no changelog provided

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre     Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can     provide a malicious file to trigger this vulnerability. (CVE-2024-25569)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c5909efa5c advisory.

    Automatic update for gdcm-3.0.23-5.fc41.

    ##### **Changelog**

    ```
    * Fri Apr 26 2024 Sandro <devel@penguinpee.nl> - 3.0.23-5
    - Apply security patches
    - Fix TALOS-2024-1924, CVE-2024-22391 (RHBZ#2277288)
    - Fix TALOS-2024-1935, CVE-2024-22373 (RHBZ#2277292)
    - Fix TALOS-2024-1944, CVE-2024-25569 (RHBZ#2277296)
    * Fri Apr 19 2024 Sandro <devel@penguinpee.nl> - 3.0.23-4
    - Replace deprecated PyEval_CallObject() (RHBZ#2245816)
    * Fri Mar 22 2024 Srgio M. Basto <sergio@serjux.com> - 3.0.23-3
    - Update URL

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7a57842ec3 advisory.

    ### Security fixes

    - TALOS-2024-1924, CVE-2024-22391: heap overflow
    - TALOS-2024-1935, CVE-2024-22373: out-of-bounds write
    - TALOS-2024-1944, CVE-2024-25569: out-of-bounds read

    ### Bug fixes

    - Replace deprecated `PyEval_CallObject` for compatibility with Python 3.13


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fae33e6e9f advisory.

    ### Security fixes

    - TALOS-2024-1924, CVE-2024-22391: heap overflow
    - TALOS-2024-1935, CVE-2024-22373: out-of-bounds write
    - TALOS-2024-1944, CVE-2024-25569: out-of-bounds read

    ### Bug fixes

    - Replace deprecated `PyEval_CallObject` for compatibility with Python 3.13


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-11821b16ac advisory.

    ### Security fixes

    - TALOS-2024-1924, CVE-2024-22391: heap overflow
    - TALOS-2024-1935, CVE-2024-22373: out-of-bounds write
    - TALOS-2024-1944, CVE-2024-25569: out-of-bounds read

    ### Bug fixes

    - Replace deprecated `PyEval_CallObject` for compatibility with Python 3.13


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298723	openSUSE 16 Security Update : orthanc, gdcm, orthanc-authorization, orthanc-dicomweb, orthanc-gdcm, orthanc-indexer, orthanc-mysql, orthanc-neuro, orthanc-postgresql, orthanc-python, orthanc-stl, orthanc-tcia, orthanc-wsi, python-pyorthanc (openSUSE-SU-2026:20193-1)	Nessus	SuSE Local Security Checks	critical
227949	Linux Distros Unpatched Vulnerability : CVE-2024-25569	Nessus	Misc.	medium
211234	Fedora 41 : gdcm (2024-c5909efa5c)	Nessus	Fedora Local Security Checks	critical
194987	Fedora 38 : gdcm (2024-7a57842ec3)	Nessus	Fedora Local Security Checks	critical
194986	Fedora 40 : gdcm (2024-fae33e6e9f)	Nessus	Fedora Local Security Checks	critical
194984	Fedora 39 : gdcm (2024-11821b16ac)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2024-25569

medium

Tenable Plugins

critical

medium

critical

critical

critical

critical