CVE-2015-8397

The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (application crash) via an embedded JPEG-LS image with dimensions larger than the selected region in a (1) two-dimensional or (2) three-dimensional DICOM image file, which triggers an out-of-bounds read.

• CWE-125

• http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/135206/GDCM-2.6.0-2.6.1-Out-Of-Bounds-Read.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Jan/33Mailing List, Third Party Advisory
• http://sourceforge.net/p/gdcm/gdcm/ci/e547b1ded3fd21e0b0ad149f13045aa12d4b9b7c/Patch, Third Party Advisory
• http://sourceforge.net/p/gdcm/mailman/message/34670701/Exploit, Third Party Advisory
• http://sourceforge.net/p/gdcm/mailman/message/34687533/Exploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/537263/100/0/threadedThird Party Advisory, VDB Entry
• http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/135206/GDCM-2.6.0-2.6.1-Out-Of-Bounds-Read.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Jan/33Mailing List, Third Party Advisory
• http://sourceforge.net/p/gdcm/gdcm/ci/e547b1ded3fd21e0b0ad149f13045aa12d4b9b7c/Patch, Third Party Advisory
• http://sourceforge.net/p/gdcm/mailman/message/34670701/Exploit, Third Party Advisory
• http://sourceforge.net/p/gdcm/mailman/message/34687533/Exploit, Third Party Advisory
• http://www.securityfocus.com/archive/1/537263/100/0/threadedThird Party Advisory, VDB Entry

Published

Jan 12, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8391The pcre_compile function in pcre_compile.c in PCRE before 8…9.8
• CVE-2015-8392PCRE before 8.38 mishandles certain instances of the (?| sub…
• CVE-2015-8393pcregrep in PCRE before 8.38 mishandles the -q option for bi…7.5
• CVE-2015-8394PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits…9.8
• CVE-2015-8395PCRE before 8.38 mishandles certain references, which allows…
• CVE-2015-8396Integer overflow in the ImageRegionReader::ReadIntoBuffer fu…
• CVE-2015-8398Cross-site scripting (XSS) vulnerability in Atlassian Conflu…
• CVE-2015-8399Atlassian Confluence before 5.8.17 allows remote authenticat…
• CVE-2015-8400The HTTPS fallback implementation in Shell In A Box (aka she…
• CVE-2015-8401Use-after-free vulnerability in Adobe Flash Player before 18…
• CVE-2015-8402Use-after-free vulnerability in Adobe Flash Player before 18…
• CVE-2015-8403Use-after-free vulnerability in Adobe Flash Player before 18…