CVE-2018-14340: High severity wireshark vulnerability
Published Jul 19, 2018
·Updated
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuffzlib.c by rejecting negative lengths to avoid a buffer over-read.
Affected Software
4 affected components
Wireshark Wireshark>=2.2.0<=2.2.15
Wireshark Wireshark>=2.4.0<=2.4.7
Wireshark Wireshark>=2.6.0<=2.6.1
Debian Debian Linux=8.0
Remediation
Event History
Jul 19, 2018
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-14340?
CVE-2018-14340 has been rated as a moderate severity vulnerability.
2
How do I fix CVE-2018-14340?
To fix CVE-2018-14340, upgrade Wireshark to versions 2.6.2, 2.4.8, or 2.2.16 or later.
3
What versions of Wireshark are affected by CVE-2018-14340?
CVE-2018-14340 affects Wireshark versions 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15.
4
What type of vulnerability is CVE-2018-14340?
CVE-2018-14340 is a buffer over-read vulnerability related to zlib decompression in Wireshark.
5
Does CVE-2018-14340 affect Debian Linux?
Yes, CVE-2018-14340 affects Debian Linux 8.0 when using vulnerable versions of Wireshark.