high7.5
CVE-2019-16319
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop.
Impact
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wireshark | Wireshark | from 2.6.0 through 2.6.10 from 3.0.0 through 3.0.3 |
| Opensuse | Leap | Version 15.1 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16020
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=02ddd49885c6a09e936a76aceb726ed06539704a
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://www.wireshark.org/security/wnpa-sec-2019-21.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16020
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=02ddd49885c6a09e936a76aceb726ed06539704a
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://www.wireshark.org/security/wnpa-sec-2019-21.html