medium6.5
CVE-2018-5335
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash.
Impact
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wireshark | Wireshark | from 2.2.0 through 2.2.11 from 2.4.0 through 2.4.3 |
| Debian | Debian Linux | Versions 7.0, 8.0, 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/102500
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14251
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=086b87376b988c555484349aa115d6e08ac6db07
- https://lists.debian.org/debian-lts-announce/2018/01/msg00032.html
- https://www.debian.org/security/2018/dsa-4101
- https://www.wireshark.org/security/wnpa-sec-2018-04.html
- http://www.securityfocus.com/bid/102500
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14251
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=086b87376b988c555484349aa115d6e08ac6db07
- https://lists.debian.org/debian-lts-announce/2018/01/msg00032.html
- https://www.debian.org/security/2018/dsa-4101
- https://www.wireshark.org/security/wnpa-sec-2018-04.html