CVE-2024-8645: Access of Uninitialized Pointer in Wireshark
Published Sep 10, 2024
·Updated
SPRT dissector crash in Wireshark 4.2.0 to 4.0.5 and 4.0.0 to 4.0.15 allows denial of service via packet injection or crafted capture file
Affected Software
3 affected components
Wireshark Wireshark>=4.0.0<=4.0.15, >=4.0.5<=4.2.0
Wireshark Wireshark>=4.0.0<4.0.16
Wireshark Wireshark>=4.2.0<4.2.6
Remediation
Information
Upgrade to versions 4.2.6, 4.0.16 or above.
Event History
Sep 10, 2024
CVE Published
via MITRE·10:02 AM
Data Sourced
via MITRE·10:02 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-8645?
CVE-2024-8645 has been classified as a denial-of-service vulnerability due to crashes in the SPRT dissector.
2
How do I fix CVE-2024-8645?
To mitigate CVE-2024-8645, users should update Wireshark to a version newer than 4.2.0 or later than 4.0.15.
3
What versions of Wireshark are affected by CVE-2024-8645?
CVE-2024-8645 affects Wireshark versions from 4.0.0 to 4.0.15 and from 4.2.0 to 4.0.5.
4
Can CVE-2024-8645 be exploited through packet injection?
Yes, CVE-2024-8645 can be exploited via packet injection or by using a crafted capture file.
5
What is the impact of CVE-2024-8645 on user systems?
The impact of CVE-2024-8645 is a crash of the Wireshark application, leading to a denial of service for users.