CVE-2018-9258: Input Validation
Published Apr 4, 2018
·Updated
In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources.
Affected Software
2 affected components
Wireshark Wireshark>=2.4.0<=2.4.5
Debian Debian Linux=7.0
Remediation
Event History
Apr 4, 2018
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
Description
Data Sourced
via NVD·07:29 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-9258?
CVE-2018-9258 has a medium severity rating due to the potential for a crash in the TCP dissector.
2
How do I fix CVE-2018-9258?
To fix CVE-2018-9258, update Wireshark to version 2.4.6 or later.
3
Which versions of Wireshark are affected by CVE-2018-9258?
Wireshark versions 2.4.0 through 2.4.5 are affected by CVE-2018-9258.
4
Is CVE-2018-9258 exploitable remotely?
CVE-2018-9258 is not classified as remotely exploitable as it requires local access to the application.
5
What component of Wireshark is affected by CVE-2018-9258?
The TCP dissector component of Wireshark is affected by CVE-2018-9258.