CVE-2019-19553

CWE-909CWE-4568 documents7 sources
Severity
7.5HIGH
EPSS
0.7%
top 29.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Wireshark WiresharkDebian Debian LinuxOpensuse Leap+2 more
Timeline
PublishedDec 5
Latest updateMay 24

Description

In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Debianwireshark< 3.0.7-1+3
▶NVDwireshark/wireshark2.6.0 — 2.6.12+1
▶NVDopensuse/leap15.1

Also affects: Debian Linux 9.0

🔴Vulnerability Details

3
GHSA
GHSA-gr8p-66g9-4565: In Wireshark 3↗2022-05-24
▶
CVEList
CVE-2019-19553: In Wireshark 3↗2019-12-05
▶
OSV
CVE-2019-19553: In Wireshark 3↗2019-12-05
▶

📋Vendor Advisories

2
Red Hat
wireshark: CMS dissector crash (wnpa-sec-2019-22)↗2019-08-02
▶
Debian
CVE-2019-19553: wireshark - In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. ...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-19553 wireshark: CMS dissector crash (wnpa-sec-2019-22) [fedora-all]↗2019-12-12
▶
Bugzilla
CVE-2019-19553 wireshark: CMS dissector crash (wnpa-sec-2019-22)↗2019-12-12
▶
CVE-2019-19553 (HIGH CVSS 7.5) | In Wireshark 3.0.0 to 3.0.6 and 2.6 | cvebase.io