CVEvulnerability

CVE-2015-8733

5.5 MEDIUM Published 2016-01-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-01-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20

Description

The ngsniffer_process_record function in wiretap/ngsniffer.c in the Sniffer file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the relationships between record lengths and record header lengths, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.

Affected configurations

• wireshark wireshark 1.12.0 • wireshark wireshark 1.12.1 • wireshark wireshark 1.12.2 • wireshark wireshark 1.12.3 • wireshark wireshark 1.12.4 • wireshark wireshark 1.12.5 • wireshark wireshark 1.12.6 • wireshark wireshark 1.12.7 • wireshark wireshark 1.12.8 • wireshark wireshark 2.0.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References