CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-3809
https://notcve.org/view.php?id=CVE-2015-3809
The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. La función dissect_lbmr_pser en epan/dissectors/packet-lbmr.c en el disector LBMR en Wireshark 1.12.x anterior a 1.12.5 no rastrea correctamente el desplazamiento actual, lo que permite a atacantes remotos causar una denegación de servicio (bucle infinito) a través de un paquete manipulado. • http://www.debian.org/security/2015/dsa-3277 http://www.securityfocus.com/bid/74632 http://www.wireshark.org/security/wnpa-sec-2015-12.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11036 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c19860dba8d158c42865c3d9051b6f318cb41169 https://security.gentoo.org/glsa/201510-03 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 0%CPEs: 21EXPL: 0CVE-2015-3814
https://notcve.org/view.php?id=CVE-2015-3814
The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. Las funciones (1) dissect_tfs_request y (2) dissect_tfs_response en epan/dissectors/packet-ieee80211.c en el disector IEEE 802.11 en Wireshark 1.10.x anterior a 1.10.14 y 1.12.x anterior a 1.12.5 interpretan un valor cero como una longitud en lugar de una condición de error, lo que permite a atacantes remotos causar una denegación de servicio (bucle infinito) a través de un paquete manipulado. • http://www.debian.org/security/2015/dsa-3277 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.securityfocus.com/bid/74631 http://www.wireshark.org/security/wnpa-sec-2015-17.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11110 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e243b0041328980a9bbd43bb8a8166d7422f9096 https://security.gentoo.org/glsa/201510-03 • CWE-189: Numeric Errors •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2015-3810 – wireshark: WebSocket DoS (wnpa-sec-2015-13)
https://notcve.org/view.php?id=CVE-2015-3810
epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet. epan/dissectors/packet-websocket.c en el disector WebSocket en Wireshark 1.12.x anterior a 1.12.5 utiliza un algoritmo recursivo, lo que permite a atacantes remotos causar una denegación de servicio (consumo de CPU) a través de un paquete manipulado. • http://www.debian.org/security/2015/dsa-3277 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.securityfocus.com/bid/74629 http://www.wireshark.org/security/wnpa-sec-2015-13.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10989 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4ee6bcbd2e03a25f1e6b0239558d9edeaf8040c0 https://security.gentoo.org/glsa/201510-03 https://access.redhat.com/security/cve/CVE-2015-3810 https:/& • CWE-399: Resource Management Errors CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2015-3906
https://notcve.org/view.php?id=CVE-2015-3906
The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815. La función logcat_dump_text en wiretap/logcat.c en el analizador sintáctico de ficheros de Android Logcat en Wireshark 1.12.x anterior a 1.12.5 no maneja correctamente la falta de la terminación \0, lo que permite a atacantes remotos causar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de un mensaje manipulado en un paquete, una vulnerabilidad diferente a CVE-2015-3815. • http://www.securityfocus.com/bid/74837 http://www.wireshark.org/security/wnpa-sec-2015-18.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11188 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b3b1f7c3aa2233a147294bad833b748d38fba84d https://security.gentoo.org/glsa/201510-03 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 21EXPL: 0CVE-2015-3811 – wireshark: WCP dissector crash (wnpa-sec-2015-14)
https://notcve.org/view.php?id=CVE-2015-3811
epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-2188. epan/dissectors/packet-wcp.c en el disector WCP en Wireshark 1.10.x anterior a 1.10.14 y 1.12.x anterior a 1.12.5 refiere incorrectamente a bytes previamente procesados, lo que permite a atacantes remotos causar una denegación de servicio (caída de aplicación) a través de un paquete manipulado, una vulnerabilidad diferente a CVE-2015-2188. A flaw was found in WCP dissector of wireshark of which an attacker could crash wireshark by injecting a specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file. • http://rhn.redhat.com/errata/RHSA-2017-0631.html http://www.debian.org/security/2015/dsa-3277 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.wireshark.org/security/wnpa-sec-2015-14.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10978 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a6fc6aa0b4efc1a1c3d7a2e3b5189e888fb6ccc2 https://security.gentoo.o • CWE-17: DEPRECATED: Code CWE-665: Improper Initialization •