CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Wireshark » Wireshark : Security Vulnerabilities (CVSS score between 5 and 5.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2018-7420 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the pcapng file parser could crash. This was addressed in wiretap/pcapng.c by adding a block-size check for sysdig event blocks.
102 CVE-2018-7419 665 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP dissector could crash. This was addressed in epan/dissectors/asn1/nbap/nbap.cnf by ensuring DCH ID initialization.
103 CVE-2018-7418 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by correcting the extraction of the length value.
104 CVE-2018-7417 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the IPMI dissector could crash. This was addressed in epan/dissectors/packet-ipmi-picmg.c by adding support for crafted packets that lack an IPMI header.
105 CVE-2018-7337 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4, the DOCSIS protocol dissector could crash. This was addressed in plugins/docsis/packet-docsis.c by removing the recursive algorithm that had been used for concatenated PDUs.
106 CVE-2018-7336 476 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the FCP protocol dissector could crash. This was addressed in epan/dissectors/packet-fcp.c by checking for a NULL pointer.
107 CVE-2018-7335 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the IEEE 802.11 dissector could crash. This was addressed in epan/crypt/airpdcap.c by rejecting lengths that are too small.
108 CVE-2018-7334 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the UMTS MAC dissector could crash. This was addressed in epan/dissectors/packet-umts_mac.c by rejecting a certain reserved value.
109 CVE-2018-7333 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpcrdma.c had an infinite loop that was addressed by validating a chunk size.
110 CVE-2018-7332 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-reload.c had an infinite loop that was addressed by validating a length.
111 CVE-2018-7331 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-ber.c had an infinite loop that was addressed by validating a length.
112 CVE-2018-7330 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thread.c had an infinite loop that was addressed by using a correct integer data type.
113 CVE-2018-7329 193 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by correcting off-by-one errors.
114 CVE-2018-7328 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-usb.c had an infinite loop that was addressed by rejecting short frame header lengths.
115 CVE-2018-7327 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-openflow_v6.c had an infinite loop that was addressed by validating property lengths.
116 CVE-2018-7326 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-lltd.c had an infinite loop that was addressed by using a correct integer data type.
117 CVE-2018-7325 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpki-rtr.c had an infinite loop that was addressed by validating a length field.
118 CVE-2018-7324 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-sccp.c had an infinite loop that was addressed by using a correct integer data type.
119 CVE-2018-7323 834 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-wccp.c had a large loop that was addressed by ensuring that a calculated length was monotonically increasing.
120 CVE-2018-7322 835 2018-02-23 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-dcm.c had an infinite loop that was addressed by checking for integer wraparound.
121 CVE-2018-7321 834 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-thrift.c had a large loop that was addressed by not proceeding with dissection after encountering an unexpected type.
122 CVE-2018-7320 2018-02-23 2020-08-24
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets.
123 CVE-2018-5336 119 Overflow 2018-01-11 2019-03-12
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth.
124 CVE-2017-17997 476 2017-12-30 2019-03-01
5.0
None Remote Low Not required None None Partial
In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343.
125 CVE-2017-17935 125 DoS 2017-12-27 2019-10-03
5.0
None Remote Low Not required None None Partial
The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line.
126 CVE-2017-17085 754 2017-12-01 2018-02-04
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length.
127 CVE-2017-17084 754 2017-12-01 2018-02-04
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length.
128 CVE-2017-17083 754 2017-12-01 2018-02-04
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed in epan/dissectors/packet-netbios.c by ensuring that write operations are bounded by the beginning of a buffer.
129 CVE-2017-15192 2017-10-10 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.
130 CVE-2017-15191 134 2017-10-10 2019-03-01
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
131 CVE-2017-15190 2017-10-10 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.
132 CVE-2017-15189 772 2017-10-10 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.
133 CVE-2017-13766 787 2017-08-30 2017-12-11
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation.
134 CVE-2017-13765 125 2017-08-30 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash. This was addressed in plugins/irda/packet-ircomm.c by adding length validation.
135 CVE-2017-13764 476 2017-08-30 2017-09-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c by adding length validation.
136 CVE-2017-11408 20 2017-07-18 2018-02-04
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
137 CVE-2017-11407 20 2017-07-18 2019-03-01
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could crash. This was addressed in epan/dissectors/packet-mq.c by validating the fragment length before a reassembly attempt.
138 CVE-2017-9766 674 DoS 2017-06-21 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c.
139 CVE-2017-9354 20 2017-06-02 2019-03-20
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address.
140 CVE-2017-9353 20 2017-06-02 2019-03-20
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.
141 CVE-2017-9351 119 Overflow 2017-06-02 2019-03-20
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.
142 CVE-2017-9348 119 Overflow 2017-06-02 2019-03-20
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-dof.c by validating a size value.
143 CVE-2017-9347 476 2017-06-02 2019-03-19
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.
144 CVE-2017-9344 369 2017-06-02 2019-03-27
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed in epan/dissectors/packet-btl2cap.c by validating an interval value.
145 CVE-2017-9343 476 2017-06-02 2019-03-19
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-msnip.c by validating an IPv4 address.
146 CVE-2017-7747 20 2017-04-12 2019-03-01
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-packetbb.c by restricting additions to the protocol tree.
147 CVE-2017-7746 835 2017-04-12 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length.
148 CVE-2017-7703 74 2017-04-12 2019-03-01
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a line's end correctly.
149 CVE-2017-6474 835 2017-03-04 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating record sizes.
150 CVE-2017-6473 20 2017-03-04 2019-03-13
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c by validating the relationships between lengths and offsets.
Total number of vulnerabilities : 293   Page : 1 2 3 (This Page)4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.