CVE-2017-6469: Input Validation
Published Mar 4, 2017
·Updated
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring that memory is allocated for a certain data structure.
Affected Software
3 affected components
Wireshark Wireshark>=2.0.0<=2.0.10
Wireshark Wireshark>=2.2.0<=2.2.4
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Mar 4, 2017
CVE Published
via MITRE·03:38 AM
Data Sourced
via MITRE·03:38 AM
Description
Data Sourced
via NVD·03:59 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-6469?
CVE-2017-6469 has a medium severity rating due to its potential to cause a denial of service.
2
How do I fix CVE-2017-6469?
To fix CVE-2017-6469, upgrade to Wireshark version 2.2.5 or later, or 2.0.11 or later.
3
What causes the CVE-2017-6469 vulnerability?
CVE-2017-6469 is caused by a crash in the LDSS dissector triggered by packet injection or a malformed capture file.
4
Which versions of Wireshark are affected by CVE-2017-6469?
Wireshark versions 2.0.0 to 2.0.10 and 2.2.0 to 2.2.4 are affected by CVE-2017-6469.
5
Is there a specific operating system affected by CVE-2017-6469?
Yes, Debian GNU/Linux 8.0 is among the affected systems for CVE-2017-6469.