Orthanc

A weakness has been identified in Orthanc Explorer 2 up to 1.12.0.

A security flaw has been discovered in Orthanc DICOM Server up to 1.12.11.

Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled.

A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images.

A heap buffer overflow vulnerability exists in the DICOM image decoder.

Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, wh…

An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`.

A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header.

An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing.

A memory exhaustion vulnerability exists in ZIP archive processing.

A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`.

A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered.

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

A heap buffer overflow vulnerability exists in the PAM image parsing logic.

An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`.

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.

Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability.