CVE-2024-24476 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Wireshark

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-126 — Buffer Over-read7 documents7 sources
Severity
7.5HIGHNVD
EPSS
2.7%
top 13.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WiresharkFedoraproject Fedora
Timeline
PublishedFeb 21

Description

A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDwireshark/wireshark< 4.2.0

Also affects: Fedora 40

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
CVE-2024-24476: A buffer overflow in Wireshark before 4↗2024-02-21
▶
GHSA
GHSA-w4cp-wh3g-wgvx: Buffer Overflow vulnerability in Wireshark team Wireshark before v↗2024-02-21
▶
OSV
CVE-2024-24476: ** DISPUTED ** A buffer overflow in Wireshark before 4↗2024-02-21
▶

📋Vendor Advisories

3
Red Hat
wireshark: Buffer Overflow via pan/addr_resolv.c and ws_manuf_lookup_str() results in Denial of Service↗2024-02-21
▶
Microsoft
A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the v↗2024-02-13
▶
Debian
CVE-2024-24476: wireshark - A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a ...↗2024
▶