CVE-2018-11357: Input Validation
Published May 22, 2018
·Updated
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.
Affected Software
4 affected components
Wireshark Wireshark>=2.2.0<=2.2.14
Wireshark Wireshark>=2.4.0<=2.4.6
Wireshark Wireshark=2.6.0
Debian Debian Linux=8.0
Remediation
Event History
May 22, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-11357?
CVE-2018-11357 is classified as a medium severity vulnerability that can lead to excessive memory consumption.
2
How do I fix CVE-2018-11357?
To fix CVE-2018-11357, upgrade Wireshark to a version later than 2.6.0 or 2.4.6 or 2.2.14.
3
Which versions of Wireshark are affected by CVE-2018-11357?
Wireshark versions 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14 are affected by CVE-2018-11357.
4
What type of vulnerability is CVE-2018-11357?
CVE-2018-11357 is a memory consumption vulnerability found in the LTP dissector and other dissectors of Wireshark.
5
Is CVE-2018-11357 present in Debian Linux 8.0?
Yes, CVE-2018-11357 may also be present in Debian GNU/Linux 8.0 if it includes vulnerable versions of Wireshark.