CVEvulnerability

CVE-2013-2488

5.0 MEDIUM Published 2013-03-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-03-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20

Description

The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.

Affected configurations

• wireshark wireshark 1.8.0 • wireshark wireshark 1.8.1 • wireshark wireshark 1.8.2 • wireshark wireshark 1.8.3 • wireshark wireshark 1.8.4 • wireshark wireshark 1.8.5 • debian debian linux 7.0 • opensuse opensuse 11.4 • opensuse opensuse 12.1 • opensuse opensuse 12.2 • opensuse opensuse 12.3 • wireshark wireshark 1.6.0 • wireshark wireshark 1.6.1 • wireshark wireshark 1.6.2 • wireshark wireshark 1.6.3 • wireshark wireshark 1.6.4 • wireshark wireshark 1.6.5 • wireshark wireshark 1.6.6 • wireshark wireshark 1.6.7 • wireshark wireshark 1.6.8 • wireshark wireshark 1.6.9 • wireshark wireshark 1.6.10 • wireshark wireshark 1.6.11 • wireshark wireshark 1.6.12 • wireshark wireshark 1.6.13

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References