CVE-2024-27629

2024-06-2819:15:05

Debian Security Bug Tracker

security-tracker.debian.org

dc2niix

local attacker

arbitrary code

file names

system call

compression

unix

8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaped and injected into a system call when certain types of compression are used.

OSVersionArchitecturePackageVersionFilename
Debian12alldcm2niix<= 1.0.20220720-1dcm2niix_1.0.20220720-1_all.deb
Debian11alldcm2niix<= 1.0.20201102-1dcm2niix_1.0.20201102-1_all.deb
Debian999alldcm2niix<= 1.0.20220720-1dcm2niix_1.0.20220720-1_all.deb
Debian13alldcm2niix<= 1.0.20220720-1dcm2niix_1.0.20220720-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dcm2niix	<= 1.0.20220720-1	dcm2niix_1.0.20220720-1_all.deb
Debian	11	all	dcm2niix	<= 1.0.20201102-1	dcm2niix_1.0.20201102-1_all.deb
Debian	999	all	dcm2niix	<= 1.0.20220720-1	dcm2niix_1.0.20220720-1_all.deb
Debian	13	all	dcm2niix	<= 1.0.20220720-1	dcm2niix_1.0.20220720-1_all.deb