high7.5
CVE-2018-9262
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash.
Impact
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. This was addressed in epan/dissectors/packet-vlan.c by limiting VLAN tag nesting to restrict the recursion depth.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wireshark | Wireshark | from 2.2.0 through 2.2.13 from 2.4.0 through 2.4.5 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14469
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f05c3b91f9571210b86576ee6284e71a3306109d
- https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
- https://www.wireshark.org/security/wnpa-sec-2018-19.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14469
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f05c3b91f9571210b86576ee6284e71a3306109d
- https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html
- https://www.wireshark.org/security/wnpa-sec-2018-19.html