CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
89.5%
Severity: Critical
Date : 2018-12-08
CVE-ID : CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625
CVE-2018-19626 CVE-2018-19627 CVE-2018-19628
Package : wireshark-cli
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-825
The package wireshark-cli before version 2.6.5-1 is vulnerable to
multiple issues including arbitrary code execution, information
disclosure and denial of service.
Upgrade to 2.6.5-1.
The problems have been fixed upstream in version 2.6.5.
None.
A security issue has been found in the MMSE dissector of Wireshark
versions prior to 2.6.5, which could be made to consume excessive CPU
resources by injecting a malformed packet onto the wire or by
convincing someone to read a malformed packet trace file
A heap-based out-of-bounds write has been found in the LBMPDM dissector
of Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file
A NULL-pointer dereference has been found in the PVFS dissector of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file
An out-of-bounds read has been found in the dissection engine of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file
An out-of-bounds read has been found in the DCOM dissector of Wireshark
versions prior to 2.6.5, which could be triggered by injecting a
malformed packet onto the wire or by convincing someone to read a
malformed packet trace file
An out-of-bounds read has been found in the IxVeriWave file parser of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file
A divide-by-zero error has been found in the ZigBee ZCL dissector of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file
A remote attacker can execute arbitrary code, access sensitive
information or crash wireshark via a crafted network packet or a
capture file.
https://www.wireshark.org/docs/relnotes/wireshark-2.6.5.html
https://www.wireshark.org/security/wnpa-sec-2018-54
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250
https://code.wireshark.org/review/#/c/30613/
https://www.wireshark.org/security/wnpa-sec-2018-53
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
https://code.wireshark.org/review/#/c/30346/
https://www.wireshark.org/security/wnpa-sec-2018-56
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15280
https://code.wireshark.org/review/#/c/30811/
https://www.wireshark.org/security/wnpa-sec-2018-51
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14466
https://code.wireshark.org/review/#/c/30152/
https://www.wireshark.org/security/wnpa-sec-2018-52
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15130
https://code.wireshark.org/review/#/c/30158/
https://www.wireshark.org/security/wnpa-sec-2018-55
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279
https://code.wireshark.org/review/#/c/30813/
https://www.wireshark.org/security/wnpa-sec-2018-57
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15281
https://code.wireshark.org/review/#/c/30810/
https://security.archlinux.org/CVE-2018-19622
https://security.archlinux.org/CVE-2018-19623
https://security.archlinux.org/CVE-2018-19624
https://security.archlinux.org/CVE-2018-19625
https://security.archlinux.org/CVE-2018-19626
https://security.archlinux.org/CVE-2018-19627
https://security.archlinux.org/CVE-2018-19628
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | wireshark-cli | < 2.6.5-1 | UNKNOWN |
bugs.wireshark.org/bugzilla/show_bug.cgi?id=14466
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15130
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15280
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15281
code.wireshark.org/review/#/c/30152/
code.wireshark.org/review/#/c/30158/
code.wireshark.org/review/#/c/30346/
code.wireshark.org/review/#/c/30613/
code.wireshark.org/review/#/c/30810/
code.wireshark.org/review/#/c/30811/
code.wireshark.org/review/#/c/30813/
security.archlinux.org/AVG-825
security.archlinux.org/CVE-2018-19622
security.archlinux.org/CVE-2018-19623
security.archlinux.org/CVE-2018-19624
security.archlinux.org/CVE-2018-19625
security.archlinux.org/CVE-2018-19626
security.archlinux.org/CVE-2018-19627
security.archlinux.org/CVE-2018-19628
www.wireshark.org/docs/relnotes/wireshark-2.6.5.html
www.wireshark.org/security/wnpa-sec-2018-51
www.wireshark.org/security/wnpa-sec-2018-52
www.wireshark.org/security/wnpa-sec-2018-53
www.wireshark.org/security/wnpa-sec-2018-54
www.wireshark.org/security/wnpa-sec-2018-55
www.wireshark.org/security/wnpa-sec-2018-56
www.wireshark.org/security/wnpa-sec-2018-57
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
89.5%