high7.5
CVE-2018-7320
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash.
Impact
In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wireshark | Wireshark | from 2.2.0 through 2.2.12 from 2.4.0 through 2.4.4 |
| Debian | Debian Linux | Versions 8.0, 9.0 |
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/103160
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14398
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=015e3399390b8b5cfbfcfcda30589983ab6cc129
- https://www.debian.org/security/2018/dsa-4217
- https://www.wireshark.org/security/wnpa-sec-2018-10.html
- http://www.securityfocus.com/bid/103160
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14398
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=015e3399390b8b5cfbfcfcda30589983ab6cc129
- https://www.debian.org/security/2018/dsa-4217
- https://www.wireshark.org/security/wnpa-sec-2018-10.html