Wireshark vulnerabilities

In Wireshark before version 2.2.12, the MRDISC dissector misuses a NULL pointer, causing the program to crash. This issue was addressed by validating an IPv4 address.

The File_read_line function in Wireshark up to version 2.2.11 does not properly strip ' ' characters, allowing remote attackers to cause application crashes via crafted packets that trigger the processing of an empty line.

In Wireshark versions 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed by ensuring that write operations are bounded by the beginning of a buffer.

In Wireshark versions 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed by adding length validation.

In Wireshark versions up to 2.0.13 and 2.2.x up to 2.2.7, the WBXML dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by adding validation of the relationships between indexes and lengths.

In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed by extracting the Vendor Class Identifier more carefully.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed by trying to detect self-referencing pointers.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed by validating an IPv4 address.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding a length check.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash due to packet injection or a malformed capture file. This was addressed by restricting additions to the protocol tree.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SIGCOMP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by correcting a memory-size check.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the RPC over RDMA dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by correctly checking for going beyond the maximum offset.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding length validation.

In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed by registering this dissector.

In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed by avoiding use of a memcmp for potentially shorter strings.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the NetScaler file parser triggered by a malformed capture file. This was addressed by validating record sizes.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash triggered by a malformed capture file. This was addressed by validating the relationships between lengths and offsets in the code.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the RTMPT dissector triggered by packet injection or a malformed capture file. This was addressed by properly incrementing a certain sequence value.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop triggered by packet injection or a malformed capture file. This was addressed by validating the capability length in epan/dissectors/packet-wsp.c.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop triggered by packet injection or a malformed capture file. This was addressed by constraining packet lateness.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed by ensuring that memory is allocated for a certain data structure.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash triggered by a malformed capture file. This was addressed by validating the relationship between pages and records.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the Netscaler file parser triggered by a malformed capture file. This was addressed by changing the restrictions on file size.

In Wireshark version 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file can cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, leading to continuous attempts to read the same zero length packet.

Multiple memory leaks in the x11_init_protocol function in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service via a crafted packet.

Buffer overflow in the mpeg_read function in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.

The Pcapng file parser in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

A crash in the X.509IF protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

The H.245 protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

The Kerberos protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

The Bluetooth HFP Profile protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

The Bluetooth BR/EDR FHS protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

The CMS protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

The 3gpp phone log file parser in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The ESS protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The SSH protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The Bluetooth AVRCP Profile protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

The UMTS FP protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

A crash in the C12.22 protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

The Catapult DCT2000 file parser in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The Bluetooth Attribute Protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The CMS protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

A crash in the RRC protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.