CVE-2017-7746 — Infinite Loop in Wireshark

CWE-835 — Infinite Loop7 documents6 sources
Severity
7.5HIGHNVD
EPSS
2.0%
top 16.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
WiresharkDebian WiresharkDebian Linux
Timeline
PublishedApr 12
Latest updateMay 13

Description

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wireshark< wireshark 2.2.6+g32dac6a-1 (bookworm)
▶Debianwireshark/wireshark< 2.2.6+g32dac6a-1+3
▶NVDwireshark/wireshark18 versions+17

Also affects: Debian Linux 8.0

Patches

Patch: bugs.wireshark.org ↗Patch: bugs.wireshark.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-vxr4-jxwh-jjcg: In Wireshark 2↗2022-05-13
▶
OSV
CVE-2017-7746: In Wireshark 2↗2017-04-12
▶

📋Vendor Advisories

2
Red Hat
wireshark: SLSK dissector long loop (wnpa-sec-2017-19)↗2017-04-12
▶
Debian
CVE-2017-7746: wireshark - In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go int...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-7746 wireshark: SLSK dissector long loop (wnpa-sec-2017-19)↗2017-04-13
▶
Bugzilla
CVE-2017-11410 CVE-2017-7700 CVE-2017-7701 CVE-2017-7702 CVE-2017-7703 CVE-2017-7704 CVE-2017-7705 CVE-2017-7745 CVE-2017-7746 CVE-2017-7747 CVE-2017-7748 wireshark: various flaws [fedora-all]↗2017-04-13
▶