In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-nbap.c by prohibiting the self-linking of DCH-IDs.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade wireshark | May 3, 2018 | Apr 4, 2018 |
| Debian | — | Upgrade wireshark | Jun 5, 2018 | Apr 4, 2018 |
| Oracle Solaris | — | Upgrade diagnostic/wireshark/tshark to version 2.4.6-0.175.3.32.0.2.0 on Solaris 11.3Upgrade diagnostic/wireshark to version 2.4.6-0.175.3.32.0.2.0 on Solaris 11.3Upgrade diagnostic/wireshark/wireshark-common to version 2.4.6-0.175.3.32.0.2.0 on Solaris 11.3 | May 16, 2018 | Apr 4, 2018 |
| Suse | — | Upgrade libwireshark8Upgrade libwiretap10Upgrade libwsutil7Upgrade libwiretap7Upgrade libwsutil8Upgrade libwsutil11Upgrade libwireshark13Upgrade libwireshark9Upgrade wiresharkUpgrade wireshark-ui-qtUpgrade wireshark-gtkUpgrade libwscodecs1Upgrade wireshark-develUpgrade libwiretap6 | Apr 11, 2018 | Apr 4, 2018 |
| Ubuntu | — | Upgrade wireshark | Nov 19, 2024 | Apr 4, 2018 |
| Wireshark | — | Upgrade to Wireshark version 2.2.14Upgrade to Wireshark version 2.4.6 | Apr 25, 2018 | Apr 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub