CVE-2020-25862: High severity wireshark vulnerability
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changing the handling of the invalid 0xFFFF checksum.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25862?
CVE-2020-25862 is a vulnerability in Wireshark versions 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20 that could cause the TCP dissector to crash.
How severe is CVE-2020-25862?
CVE-2020-25862 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2020-25862?
To fix CVE-2020-25862, update Wireshark to version 3.2.3-1ubuntu0.1~ or install the latest available version from the official Wireshark website.
Where can I find more information about CVE-2020-25862?
You can find more information about CVE-2020-25862 in the following references: - [Wireshark GitLab Commit](https://gitlab.com/wireshark/wireshark/-/commit/7f3fe6164a68b76d9988c4253b24d43f498f1753) - [Wireshark GitLab Issue](https://gitlab.com/wireshark/wireshark/-/issues/16816) - [Wireshark Security Advisory](https://www.wireshark.org/security/wnpa-sec-2020-12.html)
What is the Common Weakness Enumeration (CWE) for CVE-2020-25862?
The Common Weakness Enumeration (CWE) for CVE-2020-25862 is CWE-354, which refers to a Improper Handling of Non-Null Terminated String.