CVE-2017-11406 — Infinite Loop in Wireshark

CWE-835 — Infinite Loop13 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 25.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
WiresharkDebian WiresharkDebian Linux
Timeline
PublishedJul 18
Latest updateMay 13

Description

In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by rejecting invalid Frame Control parameter values.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wireshark< wireshark 2.4.0-1 (bookworm)
▶Debianwireshark/wireshark< 2.4.0-1+3
▶NVDwireshark/wireshark2.0.0 — 2.0.13+1

Also affects: Debian Linux 8.0

Patches

Patch: bugs.wireshark.org ↗Patch: bugs.wireshark.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-52m7-m85h-565p: In Wireshark 2↗2022-05-13
▶
OSV
CVE-2017-11406: In Wireshark 2↗2017-07-18
▶

📋Vendor Advisories

2
Red Hat
wireshark: DOCSIS infinite loop (wnpa-sec-2017-36)↗2017-07-18
▶
Debian
CVE-2017-11406: wireshark - In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go i...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-16652 CVE-2018-11385 CVE-2018-11386 CVE-2018-11406 CVE-2018-11407 CVE-2018-11408 php-symfony: Multiple flaws↗2018-06-14
▶
Bugzilla
CVE-2017-11406 CVE-2017-11407 CVE-2017-11408 wireshark: various flaws [fedora-all]↗2017-07-19
▶
Bugzilla
CVE-2017-11406 wireshark: DOCSIS infinite loop (wnpa-sec-2017-36)↗2017-07-19
▶