CVE-2017-11411 — Improper Input Validation in Wireshark

CWE-20 — Improper Input Validation7 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 35.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WiresharkDebian Wireshark
Timeline
PublishedJul 18
Latest updateMay 13

Description

In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by adding length validation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9350.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wireshark< wireshark 2.4.0-1 (bookworm)
▶Debianwireshark/wireshark< 2.4.0-1+3
▶NVDwireshark/wireshark22 versions+21

Patches

Patch: bugs.wireshark.org ↗Patch: bugs.wireshark.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-3g9v-2x9v-4j4g: In Wireshark through 2↗2022-05-13
▶
OSV
CVE-2017-11411: In Wireshark through 2↗2017-07-18
▶

📋Vendor Advisories

2
Red Hat
wireshark: openSAFETY dissector memory exhaustion (wnpa-sec-2017-28)↗2017-06-01
▶
Debian
CVE-2017-11411: wireshark - In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector co...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-11411 CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346 CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350 CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354 wireshark: variou↗2017-06-02
▶
Bugzilla
CVE-2017-9350 CVE-2017-11411 wireshark: openSAFETY dissector memory exhaustion (wnpa-sec-2017-28)↗2017-06-02
▶