CVE-2019-12295 Information

Description

In Wireshark 3.0.0 to 3.0.1 2.6.0 to 2.6.8 and 2.4.0 to 2.4.14 the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

http://www.securityfocus.com/bid/108464 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15778 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=7b6e197da4c497e229ed3ebf6952bae5c426a820 https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html https://support.f5.com/csp/article/K06725231 https://support.f5.com/csp/article/K06725231?utm_source=f5support&utm_medium=RSS https://usn.ubuntu.com/4133-1/ https://www.wireshark.org/security/wnpa-sec-2019-19.html

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5