NetSight
IP …
high7.5

CVE-2019-12295

In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash.

Impact

In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.

Affected products

VendorProductAffected versions
WiresharkWireshark
from 2.4.0 through 2.4.14
from 2.6.0 through 2.6.8
from 3.0.0 through 3.0.1
DebianDebian Linux
Version 9.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04
F5Big-Ip Access Policy Manager
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2.8
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Advanced Firewall Manager
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2.8
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Analytics
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2.8
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Application Acceleration Manager
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2.8
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Application Security Manager
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Domain Name System
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2.8
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Edge Gateway
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Fraud Protection Service
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2
from 15.0.0 through 15.0.1
Version 15.1.0
F5Big-Ip Global Traffic Manager
from 12.1.3.6 before 12.1.5.3
from 13.1.1.2 before 13.1.3.5
from 14.0.0.3 through 14.0.1
from 14.1.0 before 14.1.2.8
from 15.0.0 through 15.0.1
Version 15.1.0

Weakness classification

CWE-674

References