CVE-2014-6422 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Wireshark

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416 — Use After Free7 documents6 sources

Severity

5.0MEDIUMNVD

EPSS

0.9%

top 24.89%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wireshark Debian Wireshark

Timeline

PublishedSep 20

Latest updateMay 17

Description

The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wireshark< wireshark 1.12.0+git+4fab41a1-1 (bookworm)

▶Debianwireshark/wireshark< 1.12.0+git+4fab41a1-1+3

▶NVDwireshark/wireshark10 versions+9

🔴Vulnerability Details

GHSA

GHSA-vf77-5656-m39r: The SDP dissector in Wireshark 1↗2022-05-17

▶

OSV

CVE-2014-6422: The SDP dissector in Wireshark 1↗2014-09-20

▶

📋Vendor Advisories

Red Hat

wireshark: RTP dissector crash (wnpa-sec-2014-12)↗2014-03-23

▶

Debian

CVE-2014-6422: wireshark - The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtable...↗2014

▶

💬Community

Bugzilla

CVE-2014-6421 CVE-2014-6422 wireshark: RTP dissector crash (wnpa-sec-2014-12)↗2014-09-17

▶

Bugzilla

CVE-2014-6430 CVE-2014-6421 CVE-2014-6422 CVE-2014-6423 CVE-2014-6424 CVE-2014-6432 CVE-2014-6431 CVE-2014-6427 CVE-2014-6428 CVE-2014-6429 wireshark: various flaws [fedora-all]↗2014-09-17

▶