dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…/dcmjs/security/advisories/GHSA-px68-xx5g-48q5 Diğer
• github.com/dcmjs-org/dcmjs/pull/497 Diğer
• github.com/…ommit/81e7e11cdefb56aa1a65bfe259648b865583ff88 Diğer
• github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0 Diğer

Kayıt geçmişi

1. 5 Kas 2026 23:18Yayımlandı

İlgili açıklar

• 9,3 CVE-2026-48705MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
• 8,8 CVE-2026-71548SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
• 2,7 CVE-2026-116472ingress-nginx mirror-target self-DOS
• 7,0 CVE-2026-94395Stack-based buffer overflow in SafeNet Authentication Client SIS token engine
• 7,2 CVE-2026-123184Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
• 5,9 CVE-2026-102927HedgeDoc: Missing validation of incoming permission values on change