high7.5
CVE-2018-9256
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash.
Impact
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in epan/dissectors/packet-lwapp.c by limiting the encapsulation levels to restrict the recursion depth.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wireshark | Wireshark | from 2.2.0 through 2.2.13 from 2.4.0 through 2.4.5 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14467
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dac48f148538c706c446e5105d84ebcb54587528
- https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
- https://www.wireshark.org/security/wnpa-sec-2018-20.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14467
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dac48f148538c706c446e5105d84ebcb54587528
- https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
- https://www.wireshark.org/security/wnpa-sec-2018-20.html