Wireshark vulnerabilities

In Wireshark before version 2.2.12, the MRDISC dissector misuses a NULL pointer, causing the program to crash. This issue was addressed by validating an IPv4 address.

The File_read_line function in Wireshark up to version 2.2.11 does not properly strip ' ' characters, allowing remote attackers to cause application crashes via crafted packets that trigger the processing of an empty line.

In Wireshark versions 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed by ensuring that write operations are bounded by the beginning of a buffer.

In Wireshark versions 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed by adding length validation.

In Wireshark versions up to 2.0.13 and 2.2.x up to 2.2.7, the WBXML dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by adding validation of the relationships between indexes and lengths.

In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed by extracting the Vendor Class Identifier more carefully.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed by trying to detect self-referencing pointers.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed by validating an IPv4 address.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding a length check.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash due to packet injection or a malformed capture file. This was addressed by restricting additions to the protocol tree.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SIGCOMP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by correcting a memory-size check.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the RPC over RDMA dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by correctly checking for going beyond the maximum offset.

In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding length validation.

In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed by registering this dissector.

In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed by avoiding use of a memcmp for potentially shorter strings.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the NetScaler file parser triggered by a malformed capture file. This was addressed by validating record sizes.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash triggered by a malformed capture file. This was addressed by validating the relationships between lengths and offsets in the code.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the RTMPT dissector triggered by packet injection or a malformed capture file. This was addressed by properly incrementing a certain sequence value.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop triggered by packet injection or a malformed capture file. This was addressed by validating the capability length in epan/dissectors/packet-wsp.c.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop triggered by packet injection or a malformed capture file. This was addressed by constraining packet lateness.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed by ensuring that memory is allocated for a certain data structure.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash triggered by a malformed capture file. This was addressed by validating the relationship between pages and records.

In Wireshark versions 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an infinite loop in the Netscaler file parser triggered by a malformed capture file. This was addressed by changing the restrictions on file size.

In Wireshark version 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file can cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, leading to continuous attempts to read the same zero length packet.

Multiple memory leaks in the x11_init_protocol function in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service via a crafted packet.

Buffer overflow in the mpeg_read function in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.

X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution.

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

The IEEE 802.11 protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The Catapult DCT2000 protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The IEEE C37.118 Synchrophasor protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 has a memory leak, leading to denial of service.

The Microsoft Network Monitor file parser in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 has a large loop, leading to denial of service.

The CSN.1 protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The MBIM protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The ZigBee ZCL protocol dissector in Wireshark versions 4.6.0 to 4.6.8 can crash, leading to denial of service.

The PEAK CAN TRC file parser in Wireshark versions 4.6.0 to 4.6.8 can crash, leading to denial of service.

The Sharkd utility in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

Crash in the SPDY protocol dissector in versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

The TTL file parser in Wireshark versions 4.6.0 to 4.6.8 has an infinite loop, leading to denial of service.

The Pcapng file parser in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

A crash in the X.509IF protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

The H.245 protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

The Kerberos protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.

The Bluetooth HFP Profile protocol dissector in Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 can crash, leading to a denial-of-service condition.