Bug#1093043: dcmtk: leftover CVE status.

From	Étienne Mollier <emollier@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1093043: dcmtk: leftover CVE status.
Date	2025-01-30 21:00 +0100
Message-ID	<KaIRI-d8GV-5@gated-at.bofh.it> (permalink)
References	(4 earlier) <K9esF-c3SE-5@gated-at.bofh.it> <K9CEH-cpEE-51@gated-at.bofh.it> <K9CY1-cq1n-3@gated-at.bofh.it> <K4WE1-8Yv7-3@gated-at.bofh.it> <K9CY1-cq1n-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Good evening,

I have pushed some changes in Salsa, in the debian/bookworm
branch[1].  Patches are applied for CVE-2024-47796 and
CVE-2024-52333, fixing the present issues.

Salvatore Bonaccorso, on 2025-01-27:
> On Mon, Jan 27, 2025 at 07:57:59PM +0100, Étienne Mollier wrote:
> > Salvatore Bonaccorso, on 2025-01-26:
> > > For bookworm: Can you fix those and ideally as well the other no-dsa
> > > CVEs in the upcoming point release?
[…]

The below CVE looks also good and the correction is pushed on
Salsa; it only required a minor change due to missing a macro
that has been defined at a later point in time:
> >   * CVE-2024-27628

I begun to have a look at that CVE but it seems to be somewhat
involved on first sight, but I haven't attempted to apply the
changes yet to see how things go actually:
> >   * CVE-2024-28130

I haven't taken the time to investigate the below issues yet:
> >   * CVE-2024-34508
> >   * CVE-2024-34509

I'll probably stop for today and will continue during the
weekend.

[1]: https://salsa.debian.org/med-team/dcmtk/-/tree/debian/bookworm?ref_type=heads

Have a nice day,  :)
-- 
  .''`.  Étienne Mollier <emollier@debian.org>
 : :' :  pgp: 8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
 `. `'   sent from /dev/pts/1, please excuse my verbosity
   `-    on air: Symphony X - Paradise Lost

Thread

Bug#1093047: dcmtk: CVE-2024-52333 Salvatore Bonaccorso <carnil@debian.org> - 2025-01-14 22:40 +0100
  Processed: Re: [Debian-med-packaging] Bug#1093043: dcmtk:  CVE-2024-47796 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-01-18 16:40 +0100
  Processed: Bug#1093047 marked as pending in dcmtk "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-01-18 17:10 +0100
  Bug#1093047: marked as pending in dcmtk Étienne Mollier <emollier@debian.org> - 2025-01-18 17:10 +0100
  Bug#1093047: marked as done (dcmtk: CVE-2024-52333) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-01-18 20:20 +0100
  Bug#1093047: Bug#1093043: [Debian-med-packaging] Bug#1093043: dcmtk: CVE-2024-47796 Salvatore Bonaccorso <carnil@debian.org> - 2025-01-26 18:20 +0100
    Bug#1093043: [Debian-med-packaging] Bug#1093047: Bug#1093043: Bug#1093043: dcmtk: CVE-2024-47796 Étienne Mollier <emollier@debian.org> - 2025-01-27 20:10 +0100
      Bug#1093043: dcmtk: leftover CVE status. Étienne Mollier <emollier@debian.org> - 2025-01-30 21:00 +0100
        Bug#1093043: dcmtk: leftover CVE status. Étienne Mollier <emollier@debian.org> - 2025-02-02 12:00 +0100
  Bug#1093047: dcmtk: leftover CVE status. Salvatore Bonaccorso <carnil@debian.org> - 2025-02-12 08:10 +0100
    Bug#1093043: dcmtk: leftover CVE status. Étienne Mollier <emollier@debian.org> - 2025-02-13 22:50 +0100
  Bug#1093047: marked as done (dcmtk: CVE-2024-52333) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-02-19 17:10 +0100

csiph-web