Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2015-8726 — Improper Input Validation in Wireshark

CWE-20 — Improper Input ValidationCWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-125 — Out-of-bounds ReadCWE-121 — Stack-based Buffer Overflow7 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
1.0%
top 23.33%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
WiresharkDebian Wireshark
Timeline
PublishedJan 4
Latest updateMay 17

Description

wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wireshark< wireshark 2.0.1+g59ea380-1 (bookworm)
▶Debianwireshark/wireshark< 2.0.1+g59ea380-1+3
▶NVDwireshark/wireshark10 versions+9

🔴Vulnerability Details

2
GHSA
GHSA-xvf3-2285-frhr: wiretap/vwr↗2022-05-17
▶
OSV
CVE-2015-8726: wiretap/vwr↗2016-01-04
▶

💥Exploits & PoCs

1
Exploit-DB
Wireshark - find_signature Stack Out-of-Bounds Read↗2015-12-16
▶

📋Vendor Advisories

2
Red Hat
wireshark: VeriWave file parser crashes (wnpa-sec-2015-44)↗2015-12-29
▶
Debian
CVE-2015-8726: wireshark - wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and ...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-8726 wireshark: VeriWave file parser crashes (wnpa-sec-2015-44)↗2016-01-06
▶