CVE-2017-7702: High severity Wireshark Wireshark vulnerability
Published Apr 12, 2017
·Updated
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation.
Affected Software
18 affected components
Wireshark Wireshark=2.0.0
Wireshark Wireshark=2.0.1
Wireshark Wireshark=2.0.2
Wireshark Wireshark=2.0.3
Wireshark Wireshark=2.0.4
Wireshark Wireshark=2.0.5
Wireshark Wireshark=2.0.6
Wireshark Wireshark=2.0.7
Wireshark Wireshark=2.0.8
Wireshark Wireshark=2.0.9
Wireshark Wireshark=2.0.10
Wireshark Wireshark=2.0.11
Wireshark Wireshark=2.2.0
Wireshark Wireshark=2.2.1
Wireshark Wireshark=2.2.2
Wireshark Wireshark=2.2.3
Wireshark Wireshark=2.2.4
Wireshark Wireshark=2.2.5
Remediation
Patch Available
Event History
Apr 12, 2017
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Data Sourced
via NVD·11:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-7702?
CVE-2017-7702 has a medium severity rating due to its potential to cause a denial of service in Wireshark.
2
How do I fix CVE-2017-7702?
To fix CVE-2017-7702, upgrade to Wireshark versions 2.2.6 or later, or 2.0.12 or later.
3
What types of Wireshark versions are affected by CVE-2017-7702?
CVE-2017-7702 affects Wireshark versions from 2.0.0 to 2.0.11 and 2.2.0 to 2.2.5.
4
What kind of attack does CVE-2017-7702 facilitate?
CVE-2017-7702 facilitates a denial of service attack via crafted WBXML packets.
5
What component of Wireshark does CVE-2017-7702 affect?
CVE-2017-7702 affects the WBXML dissector component in Wireshark.