Vulnerabilities

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

A security flaw has been discovered in Orthanc DICOM Server up to 1.12.11.

A weakness has been identified in Orthanc Explorer 2 up to 1.12.0.

A memory exhaustion vulnerability exists in ZIP archive processing.

An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing.

A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`.

A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header.

A heap buffer overflow vulnerability exists in the DICOM image decoder.

A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images.

An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `DicomImageDecoder.cpp`.

A heap buffer overflow vulnerability exists in the PAM image parsing logic.

An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`.

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation.

Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled.

Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability.

A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered.

Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrite the configuration, wh…