high7.5
CVE-2018-9260
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash.
Impact
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring that an allocation step occurs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wireshark | Wireshark | from 2.2.0 through 2.2.13 from 2.4.0 through 2.4.5 |
| Debian | Debian Linux | Versions 7.0, 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14468
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=14d6f717d8ea27688af48532edb1d29f502ea8f0
- https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
- https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
- https://www.wireshark.org/security/wnpa-sec-2018-17.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14468
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=14d6f717d8ea27688af48532edb1d29f502ea8f0
- https://lists.debian.org/debian-lts-announce/2018/05/msg00019.html
- https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
- https://www.wireshark.org/security/wnpa-sec-2018-17.html