Wireshark

Source repositories

CVEs (775)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2018-14344	Wireshark Wireshark	Hig	0.49	7.5	0.03	Jul 19, 2018	In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ISMP dissector could crash. This was addressed in epan/dissectors/packet-ismp.c by validating the IPX address length to avoid a buffer over-read.
CVE-2018-14343	Wireshark Wireshark	Hig	0.49	7.5	0.03	Jul 19, 2018	In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer.
CVE-2018-14342	Wireshark Wireshark	Hig	0.49	7.5	0.04	Jul 19, 2018	In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
CVE-2018-14341	Wireshark Wireshark	Hig	0.49	7.5	0.03	Jul 19, 2018	In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addressed in epan/dissectors/packet-dcm.c by preventing an offset overflow.
CVE-2018-14340	Wireshark Wireshark	Hig	0.49	7.5	0.03	Jul 19, 2018	In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.
CVE-2018-14339	Wireshark Wireshark	Hig	0.49	7.5	0.03	Jul 19, 2018	In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation.
CVE-2018-11362	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character.
CVE-2018-11361	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey.
CVE-2018-11360	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-gsm_a_dtap.c by fixing an off-by-one error that caused a buffer overflow.
CVE-2018-11359	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference.
CVE-2018-11358	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.
CVE-2018-11357	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.
CVE-2018-11356	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.
CVE-2018-11355	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks.
CVE-2018-11354	Wireshark Wireshark	Hig	0.49	7.5	0.03	May 22, 2018	In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling.
CVE-2018-9274	Wireshark Wireshark	Hig	0.49	7.5	0.02	Apr 4, 2018	In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_message.c has a memory leak.
CVE-2018-9273	Wireshark Wireshark	Hig	0.49	7.5	0.02	Apr 4, 2018	In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak.
CVE-2018-9272	Wireshark Wireshark	Hig	0.49	7.5	0.02	Apr 4, 2018	In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak.
CVE-2018-9271	Wireshark Wireshark	Hig	0.49	7.5	0.02	Apr 4, 2018	In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak.
CVE-2018-9270	Wireshark Wireshark	Hig	0.49	7.5	0.02	Apr 4, 2018	In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak.

CVE-2018-14344HigJul 19, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ISMP dissector could crash. This was addressed in epan/dissectors/packet-ismp.c by validating the IPX address length to avoid a buffer over-read.
CVE-2018-14343HigJul 19, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer.
CVE-2018-14342HigJul 19, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.04
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
CVE-2018-14341HigJul 19, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addressed in epan/dissectors/packet-dcm.c by preventing an offset overflow.
CVE-2018-14340HigJul 19, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.
CVE-2018-14339HigJul 19, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation.
CVE-2018-11362HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character.
CVE-2018-11361HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer overflow during FTE processing in Dot11DecryptTDLSDeriveKey.
CVE-2018-11360HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-gsm_a_dtap.c by fixing an off-by-one error that caused a buffer overflow.
CVE-2018-11359HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference.
CVE-2018-11358HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.
CVE-2018-11357HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.
CVE-2018-11356HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.
CVE-2018-11355HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks.
CVE-2018-11354HigMay 22, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.03
In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling.
CVE-2018-9274HigApr 4, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.02
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_message.c has a memory leak.
CVE-2018-9273HigApr 4, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.02
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak.
CVE-2018-9272HigApr 4, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.02
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak.
CVE-2018-9271HigApr 4, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.02
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak.
CVE-2018-9270HigApr 4, 2018
Wireshark
Wireshark
risk 0.49cvss 7.5epss 0.02
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak.

Page 5 of 39