Package: orthanc Version: 1.9.2+really1.9.1+dfsg-1+deb11u1 Severity: grave Justification: renders package unusable X-Debbugs-Cc: debian-lts@lists.debian.org
Dear Maintainer, The last dcmtk/libdcmtk15 security update (3.6.5-1+deb11u1) causes orthanc server to segfault as soon as a dicom file is received. Here is the content of syslog : Feb 3 14:02:27 quaoar systemd[1]: Started Lightweight, RESTful DICOM server for healthcare and medical research. Feb 3 14:02:46 quaoar kernel: [ 2559.234663] Orthanc[16701]: segfault at 312e42 ip 00007fea92533c90 sp 00007fea857f9988 error 4 in libdcmnet.so.15.3.6.5 (deleted)[7fea924cf000+ad000] Feb 3 14:02:46 quaoar kernel: [ 2559.248240] Code: 48 89 c2 48 c7 40 10 00 00 00 00 c6 40 18 00 48 8d 05 04 37 07 00 48 89 02 48 89 5a 20 5b 5d 41 5c e9 64 b4 f9 ff 0f 1f 40 00 <48> 83 7f 10 00 41 54 74 27 48 8b 47 08 48 8b 70 08 80 7e 18 00 75 Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Main process exited, code=killed, status=11/SEGV Feb 3 14:02:46 quaoar systemd[1]: orthanc.service: Failed with result 'signal'. I have been able to reproduce this crash on a fresh bullseye install with default configuration for everything (and just sending a dicom file on port 4242). Reverting the dcmtk/libdcmtk15 to the previous version (3.6.5-1) solves the problem, but is obviously not an acceptable solution, as it leaves the system with a security hole. Thank you by advance, Nicolas Chamouard -- System Information: Debian Release: 11.11 APT prefers oldstable-updates APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-33-cloud-amd64 (SMP w/4 CPU threads) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages orthanc depends on: ii adduser 3.118+deb11u1 ii dcmtk 3.6.5-1 ii init-system-helpers 1.60 ii libboost-filesystem1.74.0 1.74.0-9 ii libboost-iostreams1.74.0 1.74.0-9 ii libboost-locale1.74.0 1.74.0-9 ii libboost-regex1.74.0 [libboost-regex1.74.0-icu67] 1.74.0-9 ii libboost-thread1.74.0 1.74.0-9 ii libc6 2.31-13+deb11u11 ii libcivetweb1 1.13+dfsg-5 ii libcurl4 7.74.0-1.3+deb11u14 ii libdcmtk15 3.6.5-1 ii libgcc-s1 10.2.1-6 ii libjpeg62-turbo 1:2.0.6-4 ii libjsoncpp24 1.9.4-4 ii liblua5.3-0 5.3.3-1.1+deb11u1 ii libpng16-16 1.6.37-3 ii libpugixml1v5 1.11.4-1 ii libsqlite3-0 3.34.1-3+deb11u1 ii libssl1.1 1.1.1w-0+deb11u2 ii libstdc++6 10.2.1-6 ii libuuid1 2.36.1-8+deb11u2 ii locales 2.31-13+deb11u11 ii lsb-base 11.1.0 ii tzdata 2024b-0+deb11u1 ii zlib1g 1:1.2.11.dfsg-2+deb11u2 orthanc recommends no packages. orthanc suggests no packages. -- Configuration Files: /etc/orthanc/credentials.json [Errno 13] Permission non accordée: '/etc/orthanc/credentials.json' /etc/orthanc/orthanc.json changed [not included] -- no debconf information
