CVE-2014-2283: Use After Free

Published Mar 11, 2014

Updated

epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet.

Affected Software

19 affected components

Wireshark Wireshark=1.8.0

Wireshark Wireshark=1.8.1

Wireshark Wireshark=1.8.2

Wireshark Wireshark=1.8.3

Wireshark Wireshark=1.8.4

Wireshark Wireshark=1.8.5

Wireshark Wireshark=1.8.6

Wireshark Wireshark=1.8.7

Wireshark Wireshark=1.8.8

Wireshark Wireshark=1.8.9

Wireshark Wireshark=1.8.10

Wireshark Wireshark=1.8.11

Wireshark Wireshark=1.8.12

Wireshark Wireshark=1.10.0

Wireshark Wireshark=1.10.1

Wireshark Wireshark=1.10.2

Wireshark Wireshark=1.10.3

Wireshark Wireshark=1.10.4

Wireshark Wireshark=1.10.5

Remediation

Patch Available

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=217293ba4a0353bf5d657e74fe8623dd3c86fe08

Event History

Mar 11, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·01:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2283?

CVE-2014-2283 has a severity rating that indicates it can lead to a denial of service due to a use-after-free vulnerability.

What software versions are affected by CVE-2014-2283?

CVE-2014-2283 affects Wireshark versions 1.8.0 through 1.8.12 and 1.10.0 through 1.10.5.

How do I fix CVE-2014-2283?

To fix CVE-2014-2283, upgrade Wireshark to version 1.8.13 or 1.10.6 or later.

What type of attack does CVE-2014-2283 enable?

CVE-2014-2283 enables remote attackers to crash the application via crafted UMTS Radio Link Control packets.

Is there a workaround for CVE-2014-2283?

There are no known workarounds for CVE-2014-2283; updating to a patched version is necessary.