CVE-2018-14368: High severity wireshark vulnerability
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by properly handling items that are too long.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14368?
The CVE-2018-14368 vulnerability is considered to have a medium severity due to the infinite loop it can cause in Wireshark.
How do I fix CVE-2018-14368?
To fix CVE-2018-14368, upgrade Wireshark to version 2.6.2 or later, 2.4.8 or later, or 2.2.16 or later.
Which versions of Wireshark are affected by CVE-2018-14368?
CVE-2018-14368 affects Wireshark versions 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15.
Does CVE-2018-14368 affect Debian users?
Yes, CVE-2018-14368 can affect users of Debian GNU/Linux 8.0 if they are using the vulnerable versions of Wireshark.
How does CVE-2018-14368 impact Wireshark's functionality?
CVE-2018-14368 causes the Bazaar protocol dissector in Wireshark to go into an infinite loop, potentially leading to a denial of service.