Re: Bug#1122926: dcmtk: CVE-2025-14607 and CVE-2025-14841

--Xcf1lkAMYKA1+RsM
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Mathieu,

Mathieu Malaterre, on 2026-02-17:
> Le lun. 16 f=C3=A9vr. 2026 =C3=A0 22:30, =C3=89tienne Mollier <emollier@d=
ebian.org> a =C3=A9crit :
> > Greetings,
> >
> > In #1127756, Adrian Bunk spotted a build failure of dcmtk on
> > s390x.  I have spent a bit of time trying to check whether
> > addressing the issue was manageable.  After determining I would
> > get nowhere, I have contacted upstream via their contact mail
> > address dedicated to bug report ; see their CONTRIBUTING.md
> > file.  If the calendar plays well, dcmtk 3.7.0 may be sprint
> > material for the upcoming weekend.  If not, well, at least I
> > woule have tried.
>=20
> I am pretty sure this is just a false positive. The code base of DCMTK
> is compatible with big-endian. I suspect you'll get an answer from the
> team real time soon. In case they are busy I suggest you go ahead with
> the experimental upload with the test disabled.

Thanks for your thoughts, although the feedback I got sounded
like there was indeed a problem in produced data (as opposed to
expected data I believe).  From DCMTK Team, on 2026-02-17:

> > > In this case, the pixel data of the dataset produced in the failing u=
nit
> > > test indeed contains incorrect pixel data with incorrect byte order.

But I agree it is time to move forwards with the migration to
version 3.7.0 and this issue should probably not be a blocker
for a Debian experimental upload at least.  I triggered a last
s390x test build to make sure that my skip implementation goes
through and will upload at some point tomorrow evening.

Have a nice day,  :)
--=20
  .''`.  =C3=89tienne Mollier <[email protected]>
 : :' :  pgp: 8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
 `. `'   sent from /dev/pts/2, please excuse my verbosity
   `-    on air: Beethoven - Sonate pour piano n=C2=B08

--Xcf1lkAMYKA1+RsM
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEj5GyJ8fW8rGUjII2eTz2fo8NEdoFAmmU5+sACgkQeTz2fo8N
Edr4YA/7BWNL4hTTy87mOwiKer6c0mMdflA6nSL+OptIxBRznRA+9dndpuE31ToW
aGnb+DepMKfms74noCLB0JXotwhYruty8g/AinM7tnbeRxxFRPhu+jyh6bjotpYb
Yg8kyOxWTh4wx09sB/IqVg7U3F4VaCAoHrSv9ynjbBwb6Q6kDEHxMg9LPBzO6p8v
ygx9xuTJVOx6cYdDNcNre5jdLpcwIIfdAEtdE+//bwTz8OvlX6ZNDWFSJ4/AixuC
TRm93tBbhU9J0Kv6XUh+LykTFcTME40FuqFd2L2DYK3wciHzL1KLksNgbAIcLsNp
Nidu7OePhWm6++88kOWxs9kvZ443bUOlEcx9JS3rzWcasY/AX5otQXun0EaT7vx6
/zXo/e2/UXJe6th0Wv7CwKbW5zMCWNfA3xzgWB2+uPBUkF4V3jdlhZV/iSEtogXg
bhJtqWSUKtKpzgvQaGCF04tM9O93LtlttQQHoIMSZ0MdRy4ezKic/lHFG8QZxjey
IKLSnQ9LvCqfnQuIYwhjrhum1wa9AJNhvbDiQiLNfjJZDIY8ZLShDNMfzRGCdvz7
nw6NyZQbBMPyfNsgHe62UOSeoRwJND3O8/Z/zhpd/opWtJQcTbwVPZy3q7dpz8Gs
tQzVTM9bVF1hevHS/v4rFslVspQbPROOaUMx/JGR0+tuCsgaDrw=
=Sdvg
-----END PGP SIGNATURE-----

--Xcf1lkAMYKA1+RsM--