Description (CNA)
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OFFIS / DCMTK | affected 3.7.0 |
CWE
CWE-674
References
- https://support.dcmtk.org/redmine/issues/1214
- https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941
ADP enrichment
No English description supplied.
No references supplied.