CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2014-6430 – wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)
https://notcve.org/view.php?id=CVE-2014-6430
The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. La función SnifferDecompress en wiretap/ngsniffer.c en el analizador de ficheros DOS Sniffer en Wireshark 1.10.x anterior a 1.10.10 y 1.12.x anterior a 1.12.1 no valida datos de máscara de bits, lo que permite a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de un fichero manipulado. • http://linux.oracle.com/errata/ELSA-2014-1676 http://linux.oracle.com/errata/ELSA-2014-1677 http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html http://rhn.redhat.com/errata/RHSA-2014-1676.html http://rhn.redhat.com/errata/RHSA-2014-1677.html http://secunia.com/advisories/60280 http://secunia.com/advisories/60578 http://secunia.com/advisories/61929 http://secunia.com/advisories/61933 http • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2014-6429 – wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)
https://notcve.org/view.php?id=CVE-2014-6429
The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not properly handle empty input data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. La función SnifferDecompress en wiretap/ngsniffer.c en el analizador de ficheros DOS Sniffer en Wireshark 1.10.x anterior a 1.10.10 y 1.12.x anterior a 1.12.1 no maneja adecuadamente entrada de datos vacía, lo que permite a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de un fichero manipulado. • http://linux.oracle.com/errata/ELSA-2014-1676 http://linux.oracle.com/errata/ELSA-2014-1677 http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html http://rhn.redhat.com/errata/RHSA-2014-1676.html http://rhn.redhat.com/errata/RHSA-2014-1677.html http://secunia.com/advisories/60280 http://secunia.com/advisories/60578 http://secunia.com/advisories/61929 http://secunia.com/advisories/61933 http • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2014-6428 – wireshark: SES dissector crash (wnpa-sec-2014-18)
https://notcve.org/view.php?id=CVE-2014-6428
The dissect_spdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. La función dissect_spdu en epan/dissectors/packet-ses.c en el diseccionador SES en Wireshark 1.10.x anterior a 1.10.10 y 1.12.x anterior a 1.12.1 no inicializa adecuadamente ciertos valores ID, lo que permite a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de paquetes manipulados. • http://linux.oracle.com/errata/ELSA-2014-1676 http://linux.oracle.com/errata/ELSA-2014-1677 http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html http://rhn.redhat.com/errata/RHSA-2014-1676.html http://rhn.redhat.com/errata/RHSA-2014-1677.html http://secunia.com/advisories/60280 http://secunia.com/advisories/60578 http://secunia.com/advisories/61929 http://secunia.com/advisories/61933 http • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-456: Missing Initialization of a Variable •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2014-5161
https://notcve.org/view.php?id=CVE-2014-5161
The dissect_log function in plugins/irda/packet-irda.c in the IrDA dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet. La función dissect_log en plugins/irda/packet-irda.c en el diseccionador de IrDA en Wireshark 1.10.x anterior a 1.10.9 no elimina debidamente los caracteres '\n', lo que permite a atacantes remotos causar una denegación de servicio (subdesbordamiento de buffer y caída de la aplicación) a través de un paquete manipulado. • http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html http://lists.opensuse.org/opensuse-updates/2014-08/msg00025.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html http://secunia.com/advisories/57593 http://www.debian.org/security/2014/dsa-3002 http://www.wireshark.org/security/wnpa-sec-2014-08.html https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=16f8ba1bed579344df373bf38fff552ab8baf380 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 1%CPEs: 9EXPL: 1CVE-2014-5165
https://notcve.org/view.php?id=CVE-2014-5165
The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.10.x before 1.10.9 does not properly validate padding values, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet. La función dissect_ber_constrained_bitstring en epan/dissectors/packet-ber.c en el diseccionador ASN.1 BER en Wireshark 1.10.x anterior a 1.10.9 no valida debidamente los valores de relleno (padding), lo que permite a atacantes remotos causar una denegación de servicio (subdesbordamiento de buffer y caída de la aplicación) a través de un paquete manipulado. • http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html http://lists.opensuse.org/opensuse-updates/2014-08/msg00025.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html http://secunia.com/advisories/57593 http://www.debian.org/security/2014/dsa-3002 http://www.wireshark.org/security/wnpa-sec-2014-11.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10187 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=17a552666b50896a9b9dde8e • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •