CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5336
https://notcve.org/view.php?id=CVE-2018-5336
In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth. En Wireshark 2.4.0 a 2.4.3 y 2.2.0 a 2.2.11, los disectores JSON, XML, NTP, XMPP y GDB podrían cerrarse inesperadamente. Esto se trató en epan/tvbparse.c limitando la profundidad de la recursión. • http://www.securityfocus.com/bid/102504 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14253 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4f4c95cf46ba6adbd10b09747e10742801bc706b https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f6702e49a9720d173246668495eece6d77eca5b0 https://lists.debian.org/debian-lts-announce/2018/01/msg00032.html https://www.debian.org/security/2018/dsa-4101 https://www.wireshark.org/security/wnpa-sec-2018-01.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-17997
https://notcve.org/view.php?id=CVE-2017-17997
In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343. En Wireshark, en versiones anteriores a la 2.2.12, el disector MRDISC emplea de forma incorrecta un puntero NULL y se cierra inesperadamente. Esto se trató en epan/dissectors/packet-mrdisc.c validando la longitud de una dirección IPv4. • https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14299 https://code.wireshark.org/review/#/c/25063 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=80a695869c9aef2fb473d9361da068022be7cb50 https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html https://www.wireshark.org/security/wnpa-sec-2018-02.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-17935
https://notcve.org/view.php?id=CVE-2017-17935
The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line. La función File_read_line en epan/wslua/wslua_file.c en Wireshark hasta la versión 2.2.11 no elimina correctamente caracteres "\n", lo que permite que atacantes remotos provoquen una denegación de servicio (subdesbordamiento de búfer y cierre inesperado de la aplicación) mediante un paquete manipulado que da lugar al intento de procesamiento de una línea vacía. • http://www.securityfocus.com/bid/102311 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14295 https://code.wireshark.org/review/#/c/24997 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=137ab7d5681486c6d6cc8faac4300b7cd4ec0cf1 https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2017-17084
https://notcve.org/view.php?id=CVE-2017-17084
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length. En Wireshark 2.4.0 a 2.4.2 y 2.2.0 a 2.2.10, el disector IWARP_MPA podía cerrarse inesperadamente. Esto se trató en epan/dissectors/packet-iwarp-mpa.c validando la longitud de una ULPDU. • http://www.securityfocus.com/bid/102030 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14236 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=8502fe94ef9e431860921507e1a351c5e3f5c634 https://lists.debian.org/debian-lts-announce/2017/12/msg00029.html https://www.debian.org/security/2017/dsa-4060 https://www.wireshark.org/security/wnpa-sec-2017-47.html • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 1CVE-2017-17085 – Wireshark 2.4.0 < 2.4.2 / 2.2.0 < 2.2.10 - CIP Safety Dissector Crash
https://notcve.org/view.php?id=CVE-2017-17085
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length. En Wireshark 2.4.0 a 2.4.2 y 2.2.0 a 2.2.10, el disector CIP Safety podía cerrarse inesperadamente. Esto se trató en epan/dissectors/packet-cipsafety.c validando la longitud del paquete. Wireshark versions 2.4.0 through 2.4.2 and 2.2.0 through 2.2.10 suffer from a crash issue in the CIP Safety dissector. • https://www.exploit-db.com/exploits/43233 http://www.securityfocus.com/bid/102071 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14250 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f5939debe96e3c3953c6020818f1fbb80eb83ce8 https://lists.debian.org/debian-lts-announce/2017/12/msg00029.html https://www.debian.org/security/2017/dsa-4060 https://www.wireshark.org/security/wnpa-sec-2017-49.html • CWE-754: Improper Check for Unusual or Exceptional Conditions •