CVE-2018-14339: Input Validation
Published Jul 19, 2018
·Updated
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation.
Affected Software
4 affected components
Wireshark Wireshark>=2.2.0<=2.2.15
Wireshark Wireshark>=2.4.0<=2.4.7
Wireshark Wireshark>=2.6.0<=2.6.1
Debian Debian Linux=8.0
Remediation
Event History
Jul 19, 2018
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-14339?
CVE-2018-14339 has a severity rating of medium due to potential denial of service caused by an infinite loop.
2
How do I fix CVE-2018-14339?
To fix CVE-2018-14339, update Wireshark to versions 2.6.2, 2.4.8, or 2.2.16 or later.
3
Which versions of Wireshark are affected by CVE-2018-14339?
CVE-2018-14339 affects Wireshark versions 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15.
4
What type of vulnerability is CVE-2018-14339?
CVE-2018-14339 is a denial of service vulnerability due to an infinite loop in the MMSE dissector.
5
Is there a patch available for CVE-2018-14339?
Yes, patches addressing CVE-2018-14339 are included in the updated versions of Wireshark.