CVE-2023-2858
published 2023-05-26CVE-2023-2858: NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
PriorityP428medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
1.77%
75.7th percentile
NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wireshark | < wireshark 4.0.6-1~deb12u1 (bookworm) | wireshark 4.0.6-1~deb12u1 (bookworm) |
| linux | linux_kernel | >= 5.11.0 < 5.15.121 | 5.15.121 |
| linux | linux_kernel | >= 5.16.0 < 6.1.40 | 6.1.40 |
| linux | linux_kernel | >= 5.6.0 < 5.10.188 | 5.10.188 |
| linux | linux_kernel | >= 6.2.0 < 6.4.5 | 6.4.5 |
| wireshark | wireshark | >= 0 < 3.4.16-0+deb11u1 | 3.4.16-0+deb11u1 |
| wireshark | wireshark | >= 0 < 4.0.6-1~deb12u1 | 4.0.6-1~deb12u1 |
| wireshark | wireshark | >= 0 < 4.0.6-1 | 4.0.6-1 |
| wireshark | wireshark | >= 0 < 4.0.6-1 | 4.0.6-1 |
| wireshark | wireshark | >= 3.6.0 < 3.6.14 | 3.6.14 |
| wireshark | wireshark | >= 4.0.0 < 4.0.6 | 4.0.6 |
| wireshark_foundation | wireshark | — | — |
| wireshark_foundation | wireshark | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: bpf: Skip task with pid=1 in send_signal_common()
vendor_redhat·2025-03-27·CVSS 5.5
CVE-2023-52992 [MEDIUM] CWE-364 kernel: bpf: Skip task with pid=1 in send_signal_common()
kernel: bpf: Skip task with pid=1 in send_signal_common()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip task with pid=1 in send_signal_common()
The following kernel panic can be triggered when a task with pid=1 attaches
a prog that attempts to send killing signal to itself, also see [1] for more
details:
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
CPU: 3 PID: 1 Comm: systemd Not tainted 6.1.0-09652-g59fe41b5255f #148
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x100/0x178 lib/dump_stack.c:106
panic+0x2c4/0x60f kernel/panic.c:275
do_exit.cold+0x63/0xe4 kernel/exit.c:789
do_group_exit+0xd4/0x2a0 kernel/exit.c:950
get_signal+0x2460/0x2600 kernel/signal.c:2858
arch_do_signal_or_restart+0x78/0x5d0 arch/x86/ke
Red Hat
wireshark: NetScaler file parser crash
vendor_redhat·2023-05-17·CVSS 5.3
CVE-2023-2858 [MEDIUM] CWE-122 wireshark: NetScaler file parser crash
wireshark: NetScaler file parser crash
NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
A flaw was found in the NetScaler file parser of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service.
Package: wireshark (Red Hat Enterprise Linux 6) - Out of support scope
Package: wireshark (Red Hat Enterprise Linux 7) - Out of support scope
Debian
CVE-2023-2858: wireshark - NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allo...
vendor_debian·2023·CVSS 5.3
CVE-2023-2858 [MEDIUM] CVE-2023-2858: wireshark - NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allo...
NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Scope: local
bookworm: resolved (fixed in 4.0.6-1~deb12u1)
bullseye: resolved (fixed in 3.4.16-0+deb11u1)
forky: resolved (fixed in 4.0.6-1)
sid: resolved (fixed in 4.0.6-1)
trixie: resolved (fixed in 4.0.6-1)
OSV
net: prevent skb corruption on frag list segmentation
osv·2025-12-24
CVE-2023-54094 net: prevent skb corruption on frag list segmentation
net: prevent skb corruption on frag list segmentation
In the Linux kernel, the following vulnerability has been resolved:
net: prevent skb corruption on frag list segmentation
Ian reported several skb corruptions triggered by rx-gro-list,
collecting different oops alike:
[ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0
[ 62.631083] #PF: supervisor read access in kernel mode
[ 62.636312] #PF: error_code(0x0000) - not-present page
[ 62.641541] PGD 0 P4D 0
[ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364
[ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022
[ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858
./include/linux/udp.h:23 net/i
OSV
CVE-2023-2858: NetScaler file parser crash in Wireshark 4
osv·2023-05-26·CVSS 6.5
CVE-2023-2858 [MEDIUM] CVE-2023-2858: NetScaler file parser crash in Wireshark 4
NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
GHSA
GHSA-wcmq-57jj-6qwc: NetScaler file parser crash in Wireshark 4
ghsa_unreviewed·2023-05-26
CVE-2023-2858 [MEDIUM] CWE-787 GHSA-wcmq-57jj-6qwc: NetScaler file parser crash in Wireshark 4
NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2858.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/19081https://lists.debian.org/debian-lts-announce/2023/06/msg00004.htmlhttps://security.gentoo.org/glsa/202309-02https://www.debian.org/security/2023/dsa-5429https://www.wireshark.org/security/wnpa-sec-2023-15.htmlhttps://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2858.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/19081https://lists.debian.org/debian-lts-announce/2023/06/msg00004.htmlhttps://lists.debian.org/debian-lts-announce/2024/09/msg00049.htmlhttps://security.gentoo.org/glsa/202309-02https://www.debian.org/security/2023/dsa-5429https://www.wireshark.org/security/wnpa-sec-2023-15.html
2023-05-26
Published