CVE-2023-3648: Mismatched Memory Management Routines in Wireshark
Published Jul 14, 2023
·Updated
Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file
Affected Software
2 affected components
Wireshark Wireshark>=3.6.0<=3.6.14
Wireshark Wireshark>=4.0.0<=4.0.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wiresharkto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
wiresharkto a version that resolves this vulnerability.Fixed in 3.6.15
Event History
Jul 14, 2023
CVE Published
via MITRE·06:16 AM
Data Sourced
via MITRE·06:16 AM
RemedyDescriptionSeverityWeakness
Data Sourced
07:15 AM
Description
Data Sourced
via NVD·07:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2023-3648.
2
What is the severity of CVE-2023-3648?
The severity of CVE-2023-3648 is medium with a score of 5.5.
3
Which software versions are affected by CVE-2023-3648?
Wireshark versions 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 are affected by CVE-2023-3648.
4
How does CVE-2023-3648 allow denial of service?
CVE-2023-3648 allows denial of service via packet injection or crafted capture file.
5
Is there a fix available for CVE-2023-3648?
Yes, please refer to the official Wireshark security advisory for available fixes.