Memory corruption in Wireshark - CVE-2018-7418

Vulnerability identifier: #VU10765

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7418

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to boundary error in epan/dissectors/packet-sigcomp.c when extraction of the length value. A remote attacker can cause the SIGCOMP dissector to crash.

Wireshark
wireshark (Red Hat package)
wireshark (Alpine package)
wireshark
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Fedora

Update to version 2.2.13, 2.4.5.

wireshark (Red Hat package) - update to 1.10.14-24.el7
wireshark (Alpine package) - update to 2.2.15-r0
wireshark - addressed in versions 2.4.5-1.fc27, 2.4.5-1.fc28, 2.4.5-2.fc27, 2.4.5-2.fc28, 2.4.5-3.fc27, 2.4.5-3.fc28

• https://www.wireshark.org/security/wnpa-sec-2018-13.html

• Denial of service in Wireshark
• Red Hat Enterprise Linux 7 update for wireshark
• Memory corruption in wireshark (Alpine package)
• Fedora 28 update for wireshark
• Fedora 27 update for wireshark
• Fedora 28 update for wireshark
• Fedora 27 update for wireshark
• Fedora 28 update for wireshark
• Fedora 27 update for wireshark