CVE-2017-7748: High severity Wireshark Wireshark vulnerability
Published Apr 12, 2017
·Updated
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check.
Affected Software
18 affected components
Wireshark Wireshark=2.0.0
Wireshark Wireshark=2.0.1
Wireshark Wireshark=2.0.2
Wireshark Wireshark=2.0.3
Wireshark Wireshark=2.0.4
Wireshark Wireshark=2.0.5
Wireshark Wireshark=2.0.6
Wireshark Wireshark=2.0.7
Wireshark Wireshark=2.0.8
Wireshark Wireshark=2.0.9
Wireshark Wireshark=2.0.10
Wireshark Wireshark=2.0.11
Wireshark Wireshark=2.2.0
Wireshark Wireshark=2.2.1
Wireshark Wireshark=2.2.2
Wireshark Wireshark=2.2.3
Wireshark Wireshark=2.2.4
Wireshark Wireshark=2.2.5
Remediation
Patch Available
Event History
Apr 12, 2017
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Data Sourced
via NVD·11:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-7748?
CVE-2017-7748 has been classified as a medium severity vulnerability due to the potential for denial of service.
2
How do I fix CVE-2017-7748?
To remediate CVE-2017-7748, users should upgrade to Wireshark version 2.2.6 or later, or 2.0.12 or later.
3
What versions of Wireshark are affected by CVE-2017-7748?
CVE-2017-7748 affects Wireshark versions 2.0.0 to 2.0.11 and 2.2.0 to 2.2.5.
4
What type of attack can exploit CVE-2017-7748?
CVE-2017-7748 can be exploited through packet injection or by using a malformed capture file.
5
Is CVE-2017-7748 a critical vulnerability?
CVE-2017-7748 is not considered a critical vulnerability, but it can lead to an infinite loop and denial of service scenario.