Candidate: CVE-2015-8397
PublicDate: 2016-01-12 20:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8397
 http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/
Description:
 The JPEGLSCodec::DecodeExtent function in
 MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka
 GDCM) before 2.6.2 allows remote attackers to obtain sensitive information
 from process memory or cause a denial of service (application crash) via an
 embedded JPEG-LS image with dimensions larger than the selected region in a
 (1) two-dimensional or (2) three-dimensional DICOM image file, which
 triggers an out-of-bounds read.
Ubuntu-Description:
 It was discovered that GDCM incorrectly handled certain DICOM image files. An
 attacker could possibly use this issue to cause a denial of service or obtain
 sensitive information from process memory.
Notes:
Bugs:
Priority: low
Discovered-by: Stelios Tsampas
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H [8.2 HIGH]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L [6.5 MEDIUM]

Patches_gdcm:
 upstream: http://sourceforge.net/p/gdcm/gdcm/ci/e547b1ded3fd21e0b0ad149f13045aa12d4b9b7c/
upstream_gdcm: released (2.6.2-1)
precise_gdcm: ignored (reached end-of-life)
precise/esm_gdcm: DNE (precise was needs-triage)
trusty_gdcm: ignored (out of standard support)
trusty/esm_gdcm: needed
vivid_gdcm: ignored (reached end-of-life)
vivid/stable-phone-overlay_gdcm: DNE
vivid/ubuntu-core_gdcm: DNE
wily_gdcm: ignored (reached end-of-life)
xenial_gdcm: not-affected (2.6.2-2)
yakkety_gdcm: not-affected (2.6.2-2)
zesty_gdcm: not-affected (2.6.2-2)
artful_gdcm: not-affected (2.6.2-2)
bionic_gdcm: not-affected (2.6.2-2)
cosmic_gdcm: not-affected (2.6.2-2)
disco_gdcm: not-affected (2.6.2-2)
eoan_gdcm: not-affected (2.6.2-2)
focal_gdcm: not-affected (2.6.2-2)
groovy_gdcm: not-affected (2.6.2-2)
hirsute_gdcm: not-affected (2.6.2-2)
impish_gdcm: not-affected (2.6.2-2)
jammy_gdcm: not-affected (2.6.2-2)
devel_gdcm: not-affected (2.6.2-2)