{
  "cveId": "CVE-2022-2120",
  "url": "https://patchblox.com/security/cve/CVE-2022-2120",
  "summary": "CVE-2022-2120 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2022-2120, released June 24, 2022. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "dcmtk: OFFIS DCMTK\u0027s (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowi...",
  "description": "OFFIS DCMTK\u0027s (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.",
  "published": "2022-06-24T08:15:00Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.03368,
  "epssPercentile": 0.88817,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dcmtk",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.6.7-6",
      "fix": "DEBIAN-CVE-2022-2120",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-2120",
      "released": "2022-06-24T15:15:10Z"
    },
    {
      "platform": "linux",
      "product": "dcmtk",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.6.7-6",
      "fix": "DEBIAN-CVE-2022-2120",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-2120",
      "released": "2022-06-24T15:15:10Z"
    },
    {
      "platform": "linux",
      "product": "dcmtk",
      "release": "Debian 14",
      "fixedVersion": "3.6.7-6",
      "fix": "DEBIAN-CVE-2022-2120",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-2120",
      "released": "2022-06-24T15:15:10Z"
    },
    {
      "platform": "linux",
      "product": "dcmtk",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.6.2-3ubuntu0.1~esm1",
      "fix": "dcmtk 3.6.2-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-dcmtk-3.6.2-3ubuntu0.1-esm1",
      "released": "2022-12-02T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "dcmtk",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.6.4-2.1ubuntu0.1~esm1",
      "fix": "dcmtk 3.6.4-2.1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-dcmtk-3.6.4-2.1ubuntu0.1-esm1",
      "released": "2022-12-02T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "dcmtk",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.6.6-5ubuntu0.1~esm1",
      "fix": "dcmtk 3.6.6-5ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-dcmtk-3.6.6-5ubuntu0.1-esm1",
      "released": "2022-12-02T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libdcmtk12",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "3.6.2-3ubuntu0.1~esm1",
      "fix": "libdcmtk12 3.6.2-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libdcmtk12-3.6.2-3ubuntu0.1-esm1",
      "released": "2022-12-02T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libdcmtk14",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.6.4-2.1ubuntu0.1~esm1",
      "fix": "libdcmtk14 3.6.4-2.1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libdcmtk14-3.6.4-2.1ubuntu0.1-esm1",
      "released": "2022-12-02T08:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libdcmtk16",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.6.6-5ubuntu0.1~esm1",
      "fix": "libdcmtk16 3.6.6-5ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libdcmtk16-3.6.6-5ubuntu0.1-esm1",
      "released": "2022-12-02T08:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}