CVE-2019-16319: High severity wireshark vulnerability
Published Sep 15, 2019
·Updated
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero.
Affected Software
4 affected components
Wireshark Wireshark>=2.6.0<=2.6.10
Wireshark Wireshark>=3.0.0<=3.0.3
openSUSE Leap=15.1
Debian Debian Linux=9.0
Remediation
Event History
Sep 15, 2019
CVE Published
via MITRE·03:15 PM
Data Sourced
via MITRE·03:15 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-16319?
CVE-2019-16319 has a medium severity rating due to the potential for an infinite loop in the Gryphon dissector.
2
How do I fix CVE-2019-16319?
To fix CVE-2019-16319, update Wireshark to version 3.0.4 or later, or to version 2.6.11 or later.
3
Which versions of Wireshark are affected by CVE-2019-16319?
CVE-2019-16319 affects Wireshark versions 2.6.0 through 2.6.10 and 3.0.0 through 3.0.3.
4
What is the nature of the vulnerability in CVE-2019-16319?
CVE-2019-16319 involves an infinite loop caused by the Gryphon dissector not properly checking for a message length of zero.
5
What are the potential impacts of CVE-2019-16319?
CVE-2019-16319 could lead to a denial of service condition by causing the application to hang.