CVE-2024-24479 — Classic Buffer Overflow in Wireshark

CWE-120 — Classic Buffer OverflowCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 37.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WiresharkFedoraproject Fedora
Timeline
PublishedFeb 21

Description

A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDwireshark/wireshark< 4.2.0

Also affects: Fedora 40

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-327r-5927-cj2v: Buffer Overflow vulnerability in Wireshark team Wireshark before v↗2024-02-21
▶
CVEList
CVE-2024-24479: A Buffer Overflow in Wireshark before 4↗2024-02-21
▶
OSV
CVE-2024-24479: ** DISPUTED ** A Buffer Overflow in Wireshark before 4↗2024-02-21
▶

📋Vendor Advisories

3
Red Hat
wireshark: Buffer Overflow via wsutil/to_str.c and format_fractional_part_nsecs results in Denial of Service↗2024-02-21
▶
Microsoft
A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. NOTE: this is disputed by the ve↗2024-02-13
▶
Debian
CVE-2024-24479: wireshark - A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a ...↗2024
▶
CVE-2024-24479 — Classic Buffer Overflow in Wireshark | cvebase