CVE-2020-26422
published 2020-12-21CVE-2020-26422: Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
4.67%
90.8th percentile
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wireshark | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
| the_wireshark_foundation | wireshark | — | — |
| wireshark | wireshark | — | — |
| wireshark | wireshark | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
wireshark: QUIC dissector crash (wnpa-sec-2020-20)
vendor_redhat·2020-12-18·CVSS 3.7
CVE-2020-26422 [LOW] CWE-125 wireshark: QUIC dissector crash (wnpa-sec-2020-20)
wireshark: QUIC dissector crash (wnpa-sec-2020-20)
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
Statement: This flaw does not affect wireshark as shipped in Red Hat Enterprise Linux 5, 6, 7, or 8 because the affected code was introduced in a more recent version of wireshark than those shipped.
Package: wireshark (Red Hat Enterprise Linux 5) - Not affected
Package: wireshark (Red Hat Enterprise Linux 6) - Not affected
Package: wireshark (Red Hat Enterprise Linux 7) - Not affected
Package: wireshark (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2020-26422: wireshark - Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of s...
vendor_debian·2020·CVSS 3.7
CVE-2020-26422 [LOW] CVE-2020-26422: wireshark - Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of s...
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-f986-fpv9-3cm7: Buffer overflow in QUIC dissector in Wireshark 3
ghsa_unreviewed·2022-05-24
CVE-2020-26422 [MEDIUM] CWE-120 GHSA-f986-fpv9-3cm7: Buffer overflow in QUIC dissector in Wireshark 3
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
OSV
CVE-2020-26422: Buffer overflow in QUIC dissector in Wireshark 3
osv·2020-12-21·CVSS 5.3
CVE-2020-26422 [MEDIUM] CVE-2020-26422: Buffer overflow in QUIC dissector in Wireshark 3
Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26422.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/17073https://security.gentoo.org/glsa/202101-12https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.wireshark.org/security/wnpa-sec-2020-20.htmlhttps://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26422.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/17073https://security.gentoo.org/glsa/202101-12https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.wireshark.org/security/wnpa-sec-2020-20.html
2020-12-21
Published