CVE-2024-27628: 
NixOS vulnerability analysis and mitigation

CVE-2024-27628 is a Buffer Overflow vulnerability discovered in DCMTK version 3.6.8. The vulnerability allows an attacker to execute arbitrary code through the EctEnhancedCT method component. The issue was reported and fixed in February 2024 (DCMTK Issue, DCMTK Commit).

The vulnerability stems from an integer overflow condition in the multiplication of rows and cols variables before conversion to size_t in the EctEnhancedCT::create method. This occurs when processing pixel data where the multiplication of rows and columns could exceed the integer limits, leading to a buffer overflow condition during memory allocation. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (NVD).

The successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. The vulnerability affects the confidentiality and integrity of the system, as indicated by the CVSS scoring which shows high impact for both these aspects (NVD).

The vulnerability requires network access and low privilege level for exploitation, with no user interaction needed, as indicated by the CVSS vector string. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

The vulnerability has been fixed in DCMTK version 3.6.9. Users are advised to upgrade to this version or later. The fix involves proper validation of pixel data size calculations and memory allocations, as implemented in commit ec52e99 (DCMTK Commit).