CVE-2011-2174: Double Free
A double free flaw was found in the way Wireshark uncompressed a zlib compressed packet inside a message of tvbuff buffer. A remote attacker could create a specially-crafted capture file, which once opened, by a local, unsuspecting user could lead to wireshark application crash.
References: [1] https://bugs.wireshark.org/bugzilla/showbug.cgi?id=5908 (upstream bug report, not public) [2] http://www.openwall.com/lists/oss-security/2011/05/31/20 (CVE request) [3] http://www.wireshark.org/security/wnpa-sec-2011-07.html (upstream advisory)
Upstream patch: [4] http://anonsvn.wireshark.org/viewvc?view=revision&revision=37081
Other sources
Double free vulnerability in the tvbuncompress function in epan/tvbuff.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a packet with malformed data that uses zlib compression.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2174?
CVE-2011-2174 has a high severity rating due to the potential for application crashes caused by specially crafted capture files.
How do I fix CVE-2011-2174?
To fix CVE-2011-2174, upgrade Wireshark to the latest version that addresses this vulnerability.
Which versions of Wireshark are affected by CVE-2011-2174?
CVE-2011-2174 affects Wireshark versions 1.2.0 to 1.2.16 and versions 1.4.0 to 1.4.6.
What kind of attack does CVE-2011-2174 facilitate?
CVE-2011-2174 facilitates a denial of service attack by crashing the Wireshark application when processing maliciously crafted capture files.
Can CVE-2011-2174 be exploited remotely?
Yes, CVE-2011-2174 can be exploited remotely if a user opens a malicious capture file in Wireshark.