high7.5
CVE-2018-14340
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash.
Impact
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wireshark | Wireshark | from 2.2.0 through 2.2.15 from 2.4.0 through 2.4.7 from 2.6.0 through 2.6.1 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- http://www.securityfocus.com/bid/104847
- http://www.securitytracker.com/id/1041608
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14675
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=672d882a53f96730e4ef1e5b1639c585823b0df8
- https://lists.debian.org/debian-lts-announce/2018/07/msg00045.html
- https://www.wireshark.org/security/wnpa-sec-2018-36.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- http://www.securityfocus.com/bid/104847
- http://www.securitytracker.com/id/1041608
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14675
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=672d882a53f96730e4ef1e5b1639c585823b0df8
- https://lists.debian.org/debian-lts-announce/2018/07/msg00045.html
- https://www.wireshark.org/security/wnpa-sec-2018-36.html