CVE-2023-2855: Medium severity wireshark vulnerability

Q: What is CVE-2023-2855?

CVE-2023-2855 is a vulnerability that allows a denial of service attack via a crafted capture file in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13.

Q: What software is affected by CVE-2023-2855?

Wireshark versions 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 are affected by CVE-2023-2855.

Q: What is the severity of CVE-2023-2855?

CVE-2023-2855 has a severity rating of 6.5 (medium).

Q: How can I fix CVE-2023-2855?

To fix CVE-2023-2855, update to Wireshark version 4.0.6 or newer.

Q: Is there any additional information about CVE-2023-2855?

Yes, you can find more information about CVE-2023-2855 in the references provided: [GitLab](https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2855.json), [Wireshark Issue](https://gitlab.com/wireshark/wireshark/-/issues/19062), [Wireshark Security Advisory](https://www.wireshark.org/security/wnpa-sec-2023-12.html).

Published May 26, 2023

Updated

Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file

Affected Software

4 affected componentsFixes available

debian/wireshark<=3.4.10-0+deb11u1

2.6.20-0+deb10u42.6.20-0+deb10u74.0.6-1~deb12u14.0.10-1

Wireshark Wireshark>=3.6.0<3.6.14

Wireshark Wireshark>=4.0.0<4.0.6

Debian Debian Linux=12.0

Remediation

Patch Available

https://gitlab.com/wireshark/wireshark/-/issues/19062

Event History

May 26, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-2855?

CVE-2023-2855 is a vulnerability that allows a denial of service attack via a crafted capture file in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13.

What software is affected by CVE-2023-2855?

Wireshark versions 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 are affected by CVE-2023-2855.

What is the severity of CVE-2023-2855?