CVE-2019-12295: High severity Wireshark Wireshark vulnerability
Published May 23, 2019
·Updated
In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.
Affected Software
85 affected componentsFixes available
Wireshark Wireshark>=2.4.0<=2.4.14
Wireshark Wireshark>=2.6.0<=2.6.8
Wireshark Wireshark>=3.0.0<=3.0.1
Debian Debian Linux=9.0
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
F5 BIG-IP Access Policy Manager>=12.1.3.6<12.1.5.3
F5 BIG-IP Access Policy Manager>=13.1.1.2<13.1.3.5
F5 BIG-IP Access Policy Manager>=14.0.0.3<=14.0.1
F5 BIG-IP Access Policy Manager>=14.1.0<14.1.2.8
F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1
F5 BIG-IP Access Policy Manager=15.1.0
F5 BIG-IP Advanced Firewall Manager>=12.1.3.6<12.1.5.3
F5 BIG-IP Advanced Firewall Manager>=13.1.1.2<13.1.3.5
F5 BIG-IP Advanced Firewall Manager>=14.0.0.3<=14.0.1
F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.2.8
F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1
F5 BIG-IP Advanced Firewall Manager=15.1.0
F5 BIG-IP Analytics>=12.1.3.6<12.1.5.3
F5 BIG-IP Analytics>=13.1.1.2<13.1.3.5
F5 BIG-IP Analytics>=14.0.0.3<=14.0.1
F5 BIG-IP Analytics>=14.1.0<14.1.2.8
F5 BIG-IP Analytics>=15.0.0<=15.0.1
F5 BIG-IP Analytics=15.1.0
F5 Big-ip Application Acceleration Manager>=12.1.3.6<12.1.5.3
F5 Big-ip Application Acceleration Manager>=13.1.1.2<13.1.3.5
F5 Big-ip Application Acceleration Manager>=14.0.0.3<=14.0.1
F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.2.8
F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1
F5 Big-ip Application Acceleration Manager=15.1.0
F5 BIG-IP Application Security Manager>=12.1.3.6<12.1.5.3
F5 BIG-IP Application Security Manager>=13.1.1.2<13.1.3.5
F5 BIG-IP Application Security Manager>=14.0.0.3<=14.0.1
F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1
F5 BIG-IP Application Security Manager=15.1.0
F5 Big-ip Domain Name System>=12.1.3.6<12.1.5.3
F5 Big-ip Domain Name System>=13.1.1.2<13.1.3.5
F5 Big-ip Domain Name System>=14.0.0.3<=14.0.1
F5 Big-ip Domain Name System>=14.1.0<14.1.2.8
F5 Big-ip Domain Name System>=15.0.0<=15.0.1
F5 Big-ip Domain Name System=15.1.0
F5 BIG-IP Edge Gateway>=12.1.3.6<12.1.5.3
F5 BIG-IP Edge Gateway>=13.1.1.2<13.1.3.5
F5 BIG-IP Edge Gateway>=14.0.0.3<=14.0.1
F5 BIG-IP Edge Gateway>=14.1.0<14.1.2
F5 BIG-IP Edge Gateway>=15.0.0<=15.0.1
F5 BIG-IP Edge Gateway=15.1.0
F5 Big-ip Fraud Protection Service>=12.1.3.6<12.1.5.3
F5 Big-ip Fraud Protection Service>=13.1.1.2<13.1.3.5
F5 Big-ip Fraud Protection Service>=14.0.0.3<=14.0.1
F5 Big-ip Fraud Protection Service>=14.1.0<14.1.2
F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1
F5 Big-ip Fraud Protection Service=15.1.0
F5 Big-ip Global Traffic Manager>=12.1.3.6<12.1.5.3
F5 Big-ip Global Traffic Manager>=13.1.1.2<13.1.3.5
F5 Big-ip Global Traffic Manager>=14.0.0.3<=14.0.1
F5 Big-ip Global Traffic Manager>=14.1.0<14.1.2.8
F5 Big-ip Global Traffic Manager>=15.0.0<=15.0.1
F5 Big-ip Global Traffic Manager=15.1.0
F5 Big-ip Link Controller>=12.1.3.6<12.1.5.3
F5 Big-ip Link Controller>=13.1.1.2<13.1.3.5
F5 Big-ip Link Controller>=14.0.0.3<=14.0.1
F5 Big-ip Link Controller>=14.1.0<14.1.2.8
F5 Big-ip Link Controller>=15.0.0<=15.0.1
F5 Big-ip Link Controller=15.1.0
F5 Big-ip Local Traffic Manager>=12.1.3.6<12.1.5.3
F5 Big-ip Local Traffic Manager>=13.1.1.2<13.1.3.5
F5 Big-ip Local Traffic Manager>=14.0.0.3<=14.0.1
F5 Big-ip Local Traffic Manager>=14.1.0<14.1.2.8
F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1
F5 Big-ip Local Traffic Manager=15.1.0
F5 Big-ip Policy Enforcement Manager>=12.1.3.6<12.1.5.3
F5 Big-ip Policy Enforcement Manager>=13.1.1.2<13.1.3.5
F5 Big-ip Policy Enforcement Manager>=14.0.0.3<=14.0.1
F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.2.8
F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1
F5 Big-ip Policy Enforcement Manager=15.1.0
F5 Big-ip Webaccelerator>=12.1.3.6<12.1.5.3
F5 Big-ip Webaccelerator>=13.1.1.2<13.1.3.5
F5 Big-ip Webaccelerator>=14.0.0.3<=14.0.1
F5 Big-ip Webaccelerator>=14.1.0<14.1.2.8
F5 Big-ip Webaccelerator>=15.0.0<=15.0.1
F5 Big-ip Webaccelerator=15.1.0
debian/wireshark
3.4.10-0+deb11u13.4.16-0+deb11u24.0.17-0+deb12u14.0.11-1~deb12u14.4.7-14.4.13-0+deb13u14.6.3-1
Remediation
Patch Available
Event History
May 23, 2019
CVE Published
via MITRE·11:56 AM
Data Sourced
via MITRE·11:56 AM
Description
Data Sourced
via NVD·12:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·10:38 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·10:38 PM
Description
Data Sourced
via Debian·10:39 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-12295?
CVE-2019-12295 is considered a high severity vulnerability due to its potential impact on the stability of the dissection engine in Wireshark.
2
How do I fix CVE-2019-12295?
To fix CVE-2019-12295, update Wireshark to version 3.4.10, 3.4.16, 4.0.11, or a later version as specified in the affected software section.
3
Which versions of Wireshark are affected by CVE-2019-12295?
CVE-2019-12295 affects Wireshark versions from 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14.
4
What kind of impact does CVE-2019-12295 have on users?
CVE-2019-12295 can lead to crashes in Wireshark's dissection engine, potentially disrupting network analysis work.
5
Is there a workaround for CVE-2019-12295 if I cannot update Wireshark?
There is no known workaround for CVE-2019-12295, so updating to a patched version is the recommended action.