CVSS: 7.1EPSS: 0%CPEs: 12EXPL: 0CVE-2016-2523
https://notcve.org/view.php?id=CVE-2016-2523
The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. La función dnp3_al_process_object en epan/dissectors/packet-dnp.c en el disector DNP3 en Wireshark 1.12.x en versiones anteriores a 1.12.10 y 2.0.x en versiones anteriores a 2.0.2 permite a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de un paquete manipulado. • http://lists.opensuse.org/opensuse-updates/2016-03/msg00015.html http://lists.opensuse.org/opensuse-updates/2016-03/msg00016.html http://www.debian.org/security/2016/dsa-3516 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1035118 http://www.wireshark.org/security/wnpa-sec-2016-03.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11938 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=260afe11feb79 • CWE-399: Resource Management Errors •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 1CVE-2015-8731 – Wireshark - dissct_rsl_ipaccess_msg Static Out-of-Bounds Read
https://notcve.org/view.php?id=CVE-2015-8731
The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not reject unknown TLV types, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. La función dissct_rsl_ipaccess_msg en epan/dissectors/packet-rsl.c en el disector RSL en Wireshark 1.12.x en versiones anteriores a 1.12.9 y 2.0.x en versiones anteriores a 2.0.1 no rechaza tipos TLV desconocidos, lo que permite a atacantes remotos causar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de un paquete manipulado. • https://www.exploit-db.com/exploits/38996 http://www.debian.org/security/2016/dsa-3516 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://www.securityfocus.com/bid/79382 http://www.securitytracker.com/id/1034551 http://www.wireshark.org/security/wnpa-sec-2015-49.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11829 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=2930d3105c3ff2bfb1278b34ad10e2e71c3b8fb0 https://security.gentoo.o • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 1CVE-2015-8725 – Wireshark - dissect_diameter_base_framed_ipv6_prefix Stack Buffer Overflow
https://notcve.org/view.php?id=CVE-2015-8725
The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the IPv6 prefix length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. La función dissect_diameter_base_framed_ipv6_prefix en epan/dissectors/packet-diameter.c en el disector DIAMETER en Wireshark 1.12.x en versiones anteriores a 1.12.9 y 2.0.x en versiones anteriores a 2.0.1 no valida la longitud del prefijo IPv6, lo que permite a atacantes remotos provocar una denegación de servicio (desbordamiento de buffer basado en pila y caída de aplicación) a través de un paquete manipulado. • https://www.exploit-db.com/exploits/39003 http://www.debian.org/security/2016/dsa-3505 http://www.securityfocus.com/bid/79382 http://www.securitytracker.com/id/1034551 http://www.wireshark.org/security/wnpa-sec-2015-43.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11792 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=aaa28a9d39158ca1033bbd3372cf423abbf4f202 https://security.gentoo.org/glsa/201604-05 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 1CVE-2015-8726 – Wireshark - find_signature Stack Out-of-Bounds Read
https://notcve.org/view.php?id=CVE-2015-8726
wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. wiretap/vwr.c en el analizador de archivo VeriWave en Wireshark 1.12.x en versiones anteriores a 1.12.9 y 2.0.x en versiones anteriores a 2.0.1 no valida ciertos datos de firma y Modulation and Coding Scheme (MCS), lo que permite a atacantes remotos provocar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de un archivo manipulado. • https://www.exploit-db.com/exploits/39004 http://www.debian.org/security/2016/dsa-3505 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://www.securityfocus.com/bid/79382 http://www.securitytracker.com/id/1034551 http://www.wireshark.org/security/wnpa-sec-2015-44.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11789 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11791 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=c • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 1CVE-2015-8729 – Wireshark - ascend_seek Static Out-of-Bounds Read
https://notcve.org/view.php?id=CVE-2015-8729
The ascend_seek function in wiretap/ascendtext.c in the Ascend file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not ensure the presence of a '\0' character at the end of a date string, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. La función ascend_seek en wiretap/ascendtext.c en el analizador de archivo Ascend en Wireshark 1.12.x en versiones anteriores a 1.12.9 y 2.0.x en versiones anteriores a 2.0.1 no asegura la presencia de de un caracter '\0' al final de una cadena fecha, lo que permite a atacantes remotos provocar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de un archivo manipulado. • https://www.exploit-db.com/exploits/39001 http://www.debian.org/security/2016/dsa-3505 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://www.securityfocus.com/bid/79382 http://www.securitytracker.com/id/1034551 http://www.wireshark.org/security/wnpa-sec-2015-47.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11794 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=338da1c0ea0b2f8595d3a7b6d6c9548f7da3e27b https://security.gentoo.o • CWE-20: Improper Input Validation •