Hi, El 03/02/25 a las 15:15, infra...@alara-group.fr escribió: > Package: orthanc > Version: 1.9.2+really1.9.1+dfsg-1+deb11u1 > Severity: grave > Justification: renders package unusable > X-Debbugs-Cc: debian-...@lists.debian.org > > Dear Maintainer, > > The last dcmtk/libdcmtk15 security update (3.6.5-1+deb11u1) causes > orthanc server to segfault as soon as a dicom file is received. > > Here is the content of syslog : > Feb 3 14:02:27 quaoar systemd[1]: Started Lightweight, RESTful DICOM server > for healthcare and medical research. > Feb 3 14:02:46 quaoar kernel: [ 2559.234663] Orthanc[16701]: segfault at > 312e42 ip 00007fea92533c90 sp 00007fea857f9988 error 4 in > libdcmnet.so.15.3.6.5 (deleted)[7fea924cf000+ad000] > Feb 3 14:02:46 quaoar kernel: [ 2559.248240] Code: 48 89 c2 48 c7 40 10 00 > 00 00 00 c6 40 18 00 48 8d 05 04 37 07 00 48 89 02 48 89 5a 20 5b 5d 41 5c e9 > 64 b4 f9 ff 0f 1f 40 00 <48> 83 7f 10 00 41 54 74 27 48 8b 47 08 48 8b 70 08 > 80 7e 18 00 75 > Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Main process exited, > code=killed, status=11/SEGV > Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Failed with result > 'signal'. > > I have been able to reproduce this crash on a fresh bullseye install with > default > configuration for everything (and just sending a dicom file on port 4242). > > Reverting the dcmtk/libdcmtk15 to the previous version (3.6.5-1) solves the > problem, but is obviously not an acceptable solution, as it leaves the system > with a security hole. > > Thank you by advance, > > Nicolas Chamouard
Thank you for this bug report. For awareness, I am explicitly CCing Adrian, who prepared the dcmtk update. Adrian are you able to look at this? Cheers, -- Santiago
signature.asc
Description: PGP signature
