Infinite loop in Wireshark - CVE-2018-19622

Vulnerability identifier: #VU16193

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19622

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to infinite loop when handling user-supplied input. A remote attacker can inject a malformed packet into a network, to be processed by the affected application, or trick the victim into opening a malicious packet trace file and cause the MMSE dissector to crash.

Wireshark
Debian Linux
Arch Linux
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Opensuse
Fedora
wireshark (Red Hat package)
wireshark (Alpine package)
wireshark

The vulnerability has been addressed in the versions 2.4.11, 2.6.5.

Wireshark - addressed in versions 2.4.11, 2.6.5
wireshark (Red Hat package) - update to 1.10.14-24.el7
wireshark (Alpine package) - addressed in versions 2.4.11-r0, 2.6.5-r0
wireshark - addressed in versions 2.6.5-1.fc28, 2.6.5-1.fc29

• https://www.wireshark.org/security/wnpa-sec-2018-54.html

• Denial of service in Wireshark
• Arch Linux update for wireshark-cli
• Debian update for wireshark
• OpenSUSE Linux update for wireshark
• Red Hat Enterprise Linux 7 update for wireshark
• OpenSUSE Linux update for wireshark
• Infinite loop in wireshark (Alpine package)
• Fedora 29 update for wireshark
• Fedora 28 update for wireshark