Vulnerabilities

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory.

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory.

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area.

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.