CVE-2018-19622: High severity wireshark vulnerability
Published Nov 29, 2018
·Updated
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-mmse.c by preventing length overflows.
Affected Software
5 affected componentsFixes available
debian/wireshark
2.6.20-0+deb10u42.6.20-0+deb10u73.4.10-0+deb11u14.0.6-1~deb12u14.0.10-1
Wireshark Wireshark>=2.4.0<=2.4.10
Wireshark Wireshark>=2.6.0<=2.6.4
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Event History
Nov 29, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-19622?
CVE-2018-19622 has a medium severity rating due to its potential to cause an infinite loop in the MMSE dissector.
2
How do I fix CVE-2018-19622?
To fix CVE-2018-19622, update Wireshark to version 2.6.20 or later for 2.6.x series or to the latest version available.
3
Which versions of Wireshark are affected by CVE-2018-19622?
Wireshark versions from 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10 are affected by CVE-2018-19622.
4
What is the impact of CVE-2018-19622?
The impact of CVE-2018-19622 is the possibility of a denial of service due to an infinite loop in the parser.
5
Is CVE-2018-19622 limited to specific operating systems?
CVE-2018-19622 primarily affects the Wireshark application regardless of the operating system, including Debian.