7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.004 Low
EPSS
Percentile
69.9%
There is an infinite loop condition in dissect_lbmr_pser() in
epan/dissectors/packet-lbmr.c. It’s possible for an attacker to set the
the variable ‘option_len’ to 0, causing the loop to never terminate.
This issue is leading to excessive CPU resources consumption by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
There is an infinite loop condition in dissect_lbmr_pser() in
epan/dissectors/packet-lbmr.c. It’s possible for an attacker to set the
the variable ‘option_len’ to 0, causing the loop to never terminate.
This issue is leading to excessive CPU resources consumption by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
The Websocket dissector recurses to dissect more data. Since the minimum
valid websocket frame length is two bytes, this allows for quite some
recursion. With a minimal IP and TCP header (20 bytes each), you can get
32747 recursions which is leading to excessive CPU resources consumption
by injecting a malformed packet onto the wire or by convincing someone
to read a malformed packet trace file.
The WCP dissector could crash while decompressing data. The compression
format is basically saying "these n bytes are the same as these other n
bytes you’ve already seen at offset X" except we haven’t processed X
bytes yet so we’re not validating that offset and are getting
uninitialized bytes leading to a crash when injecting a malformed packet
onto the wire or by convincing someone to read a malformed packet trace
file.
It has been discovered that the X11 dissector could leak memory under
certain circumstances. This may lead to crash by excessive memory
consumption via injecting malformed packets onto the wire or by
convincing someone to read a malformed packet trace file.
It has been discovered that the packet reassembly code could leak memory
under certain circumstances. This may lead to crash by excessive memory
consumption via injecting malformed packets onto the wire or by
convincing someone to read a malformed packet trace file.
It has been discovered that the IEEE 802.11 dissector could go into an
infinite loop under certain circumstances. This issue is leading to
excessive CPU resources consumption by injecting a malformed packet onto
the wire or by convincing someone to read a malformed packet trace file.
It has been discovered that the Android Logcat file parser could crash
under certain circumstances. This issue is leading to denial of service
by injecting a malformed packet onto the wire or by convincing someone
to read a malformed packet trace file.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
any | any | any | wireshark-qt | < 1.12.5-1 | UNKNOWN |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815
wireshark.org/docs/relnotes/wireshark-1.12.5.html