CVE-2024-4854: Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
First published: Tue May 14 2024(Updated: )
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wireshark | >=4.2.0<=4.2.4>=4.0.0<=4.0.14>=3.6.0<=3.6.22 |
Remedy
Upgrade to versions 4.2.5 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wireshark.org/security/wnpa-sec-2024-07.html
- https://gitlab.com/wireshark/wireshark/-/issues/19726
- https://gitlab.com/wireshark/wireshark/-/merge_requests/15047
- https://gitlab.com/wireshark/wireshark/-/merge_requests/15499
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/66H2BSENPSIALF2WIZF7M3QBVWYBMFGW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MKFJAZDKXGFFQPRDYLX2AANRNMYZZEZ/
Frequently Asked Questions
What is the severity of CVE-2024-4854?
CVE-2024-4854 has a high severity rating, as it allows denial of service through packet injection or crafted capture files.
How do I fix CVE-2024-4854?
To fix CVE-2024-4854, upgrade Wireshark to version 4.2.5 or later, 4.0.15 or later, or 3.6.23 or later.
What versions of Wireshark are affected by CVE-2024-4854?
CVE-2024-4854 affects Wireshark versions 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22.
Can I exploit CVE-2024-4854 remotely?
Yes, CVE-2024-4854 can be exploited remotely via packet injection or by sending specially crafted capture files.
What are the potential consequences of CVE-2024-4854?
The primary consequence of CVE-2024-4854 is the potential for a denial of service attack that disrupts application availability.
- agent/remedy
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- agent/references
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wireshark
- canonical/wireshark