dcmtk - Debian Package Tracker

general

source: dcmtk (main)
version: 3.7.0+really3.6.9-1
maintainer: Debian Med Packaging Team (archive) (DMD) (LowNMU)
uploaders: Mathieu Malaterre [DMD] – Gert Wollny [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.6.5-1
o-o-sec: 3.6.5-1+deb11u6
oldstable: 3.6.7-9~deb12u3
stable: 3.6.9-5
testing: 3.7.0+really3.6.9-1
unstable: 3.7.0+really3.6.9-1
exp: 3.7.0+really3.7.0-0+exp1

versioned links

3.6.5-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.5-1+deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.7-9~deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.9-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.7.0+really3.6.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.7.0+really3.7.0-0+exp1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

dcmtk
dcmtk-data
dcmtk-doc
libdcmtk-dev
libdcmtk19

action needed

4 security issues in trixie high

There are 4 open security issues in trixie.

1 important issue:

CVE-2026-5663: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

3 issues left for the package maintainer to handle:

CVE-2025-9732: (needs triaging) A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manipulation leads to memory corruption. Local access is required to approach this attack. The name of the patch is 7ad81d69b. It is best practice to apply a patch to resolve this issue.
CVE-2025-14607: (needs triaging) A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
CVE-2025-14841: (needs triaging) A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-09-01 Last update: 2026-04-07 04:30

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-5663: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
CVE-2025-14607: A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
CVE-2025-14841: A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.

Created: 2026-02-12 Last update: 2026-04-07 04:30

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-5663: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
CVE-2025-14607: A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
CVE-2025-14841: A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.

Created: 2025-12-14 Last update: 2026-04-07 04:30

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-5663: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

Created: 2026-04-06 Last update: 2026-04-07 04:30

6 security issues in bookworm high

There are 6 open security issues in bookworm.

1 important issue:

CVE-2026-5663: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

5 issues left for the package maintainer to handle:

CVE-2022-4981: (needs triaging) A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the component dcmqrscp. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit is now public and may be used. Upgrading to version 3.6.8 is sufficient to resolve this issue. The patch is identified as 957fb31e5. Upgrading the affected component is advised.
CVE-2025-2357: (needs triaging) A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
CVE-2025-9732: (needs triaging) A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manipulation leads to memory corruption. Local access is required to approach this attack. The name of the patch is 7ad81d69b. It is best practice to apply a patch to resolve this issue.
CVE-2025-14607: (needs triaging) A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
CVE-2025-14841: (needs triaging) A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-03-17 Last update: 2026-04-07 04:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.7.0+really3.7.0-0+exp2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 6be0d580747a4ff8c578d83477a201b541271057
Author: Étienne Mollier <emollier@debian.org>
Date:   Sat Feb 21 16:43:28 2026 +0100

    d/changelog: document drop of Breaks+Replaces.

commit 601188e8b9f3dbf0ffe46e2f80ef5d4dfe6cc9d6
Author: Étienne Mollier <emollier@debian.org>
Date:   Sat Feb 21 16:11:58 2026 +0100

    d/control: drop libdcmtk20 breaking and replacing libdcmtk19.
    
    After examination of the situation, the stanza was needed against the
    faulty 3.7.0-1, but it is not needed on 3.7.0+really3.6.9-1.

commit 4254fab1e93f09a0c317fc90531a1b6847cffd87
Author: Étienne Mollier <emollier@debian.org>
Date:   Thu Feb 19 22:43:35 2026 +0100

    d/changelog: initialize the changelog.

commit 24f50f27dd3e251910e259756d4a4d48108b7bd8
Author: Étienne Mollier <emollier@debian.org>
Date:   Thu Feb 19 22:41:50 2026 +0100

    d/u/metadata: eprint → Eprint.

commit 7225b33eae252cffa860d90bb3338109ab28eb87
Author: Étienne Mollier <emollier@debian.org>
Date:   Thu Feb 19 22:41:24 2026 +0100

    skip-bigendian-roundtrip-failure.patch: short form BTS URI.

commit 19229215dddedd19a9f54479d3a7e7e0f79be3a9
Author: Étienne Mollier <emollier@debian.org>
Date:   Thu Feb 19 21:59:00 2026 +0100

    d/copyright: provide working links to the AFPL.
    
    The original link from the legal text broke some time ago.
    The AFPL does not have to apply in that context anyways.

Created: 2026-02-19 Last update: 2026-04-02 12:00

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-02-13 Last update: 2026-02-13 11:35

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-02-08 Last update: 2026-02-08 08:31

debian/patches: 6 patches to forward upstream low

Among the 11 debian patches available in version 3.7.0+really3.6.9-1 of the package, we noticed the following issues:

6 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-02-13 Last update: 2026-02-13 07:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2026-02-13 Last update: 2026-03-31 15:01

testing migrations

This package will soon be part of the auto-dcmtk transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-02-20] dcmtk 3.7.0+really3.6.9-1 MIGRATED to testing (Debian testing watch)
[2026-02-19] Accepted dcmtk 3.7.0+really3.7.0-0+exp1 (source all amd64) into experimental (Debian FTP Masters) (signed by: Étienne Mollier)
[2026-02-12] Accepted dcmtk 3.7.0+really3.6.9-1 (source) into unstable (Étienne Mollier)
[2026-02-11] Accepted dcmtk 3.7.0-1 (source) into unstable (Étienne Mollier)
[2026-01-19] Accepted dcmtk 3.6.5-1+deb11u6 (source) into oldoldstable-security (Markus Koschany)
[2025-12-14] dcmtk 3.6.9-6 MIGRATED to testing (Debian testing watch)
[2025-12-10] Accepted dcmtk 3.6.9-6 (source) into unstable (Étienne Mollier)
[2025-11-03] Accepted dcmtk 3.6.5-1+deb11u5 (source) into oldoldstable-security (Markus Koschany)
[2025-06-24] Accepted dcmtk 3.6.5-1+deb11u4 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-04-30] dcmtk 3.6.9-5 MIGRATED to testing (Debian testing watch)
[2025-03-21] Accepted dcmtk 3.6.9-5 (source) into unstable (Mathieu Malaterre)
[2025-03-08] Accepted dcmtk 3.6.7-9~deb12u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Étienne Mollier)
[2025-02-26] dcmtk 3.6.9-4 MIGRATED to testing (Debian testing watch)
[2025-02-19] Accepted dcmtk 3.6.9-4 (source) into unstable (Étienne Mollier)
[2025-02-19] Accepted dcmtk 3.6.7-9~deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Étienne Mollier)
[2025-02-18] Accepted dcmtk 3.6.9-3 (source) into unstable (Mathieu Malaterre)
[2025-02-11] Accepted dcmtk 3.6.5-1+deb11u3 (source) into oldstable-security (Adrian Bunk)
[2025-02-11] Accepted dcmtk 3.6.9-2 (source) into experimental (Mathieu Malaterre)
[2025-02-10] Accepted dcmtk 3.6.5-1+deb11u2 (source) into oldstable-security (Adrian Bunk)
[2025-01-31] Accepted dcmtk 3.6.5-1+deb11u1 (source) into oldstable-security (Adrian Bunk)
[2025-01-30] Accepted dcmtk 3.6.9-1 (source all amd64) into experimental (Debian FTP Masters) (signed by: Mathieu Malaterre)
[2025-01-21] dcmtk 3.6.8-7 MIGRATED to testing (Debian testing watch)
[2025-01-18] Accepted dcmtk 3.6.8-7 (source) into unstable (Étienne Mollier)
[2024-07-10] dcmtk 3.6.8-6 MIGRATED to testing (Debian testing watch)
[2024-07-08] Accepted dcmtk 3.6.8-6 (source) into unstable (Mathieu Malaterre)
[2024-07-05] Accepted dcmtk 3.6.8-5 (source) into unstable (Mathieu Malaterre)
[2024-06-28] Accepted dcmtk 3.6.4-2.1+deb10u1 (source) into oldoldstable (Adrian Bunk)
[2024-06-27] dcmtk 3.6.7-15 MIGRATED to testing (Debian testing watch)
[2024-06-24] Accepted dcmtk 3.6.8-4 (source) into experimental (Mathieu Malaterre)
[2024-06-24] Accepted dcmtk 3.6.7-15 (source) into unstable (Santiago Vila)

bugs [bug history graph]

all: 4
RC: 0
I&N: 4
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.7.0+really3.6.9-1
4 bugs