CVE-2017-7701 — Infinite Loop in Wireshark

CWE-835 — Infinite Loop8 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 32.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WiresharkDebian Wireshark
Timeline
PublishedApr 12
Latest updateMay 13

Description

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-bgp.c by using a different integer data type.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wireshark< wireshark 2.2.6+g32dac6a-1 (bookworm)
▶Debianwireshark/wireshark< 2.2.6+g32dac6a-1+3
▶NVDwireshark/wireshark18 versions+17

Patches

Patch: bugs.wireshark.org ↗Patch: bugs.wireshark.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-x78q-89f4-5w3c: In Wireshark 2↗2022-05-13
▶
OSV
CVE-2017-7701: In Wireshark 2↗2017-04-12
▶

💥Exploits & PoCs

1
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities↗2018-03-13
▶

📋Vendor Advisories

2
Red Hat
wireshark: BGP dissector infinite loop (wnpa-sec-2017-16)↗2017-04-12
▶
Debian
CVE-2017-7701: wireshark - In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could go into...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-7701 wireshark: BGP dissector infinite loop (wnpa-sec-2017-16)↗2017-04-13
▶
Bugzilla
CVE-2017-11410 CVE-2017-7700 CVE-2017-7701 CVE-2017-7702 CVE-2017-7703 CVE-2017-7704 CVE-2017-7705 CVE-2017-7745 CVE-2017-7746 CVE-2017-7747 CVE-2017-7748 wireshark: various flaws [fedora-all]↗2017-04-13
▶