ID CVE-2018-9269
Summary In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak.
References
Vulnerable Configurations
  • Wireshark 2.2.0
    cpe:2.3:a:wireshark:wireshark:2.2.0
  • Wireshark 2.2.1
    cpe:2.3:a:wireshark:wireshark:2.2.1
  • Wireshark 2.2.2
    cpe:2.3:a:wireshark:wireshark:2.2.2
  • Wireshark 2.2.3
    cpe:2.3:a:wireshark:wireshark:2.2.3
  • Wireshark 2.2.4
    cpe:2.3:a:wireshark:wireshark:2.2.4
  • Wireshark 2.2.5
    cpe:2.3:a:wireshark:wireshark:2.2.5
  • Wireshark 2.2.6
    cpe:2.3:a:wireshark:wireshark:2.2.6
  • Wireshark 2.2.7
    cpe:2.3:a:wireshark:wireshark:2.2.7
  • Wireshark 2.2.8
    cpe:2.3:a:wireshark:wireshark:2.2.8
  • Wireshark 2.2.9
    cpe:2.3:a:wireshark:wireshark:2.2.9
  • Wireshark 2.2.10
    cpe:2.3:a:wireshark:wireshark:2.2.10
  • Wireshark 2.2.11
    cpe:2.3:a:wireshark:wireshark:2.2.11
  • Wireshark 2.2.12
    cpe:2.3:a:wireshark:wireshark:2.2.12
  • Wireshark 2.2.13
    cpe:2.3:a:wireshark:wireshark:2.2.13
  • Wireshark 2.4.0
    cpe:2.3:a:wireshark:wireshark:2.4.0
  • Wireshark 2.4.1
    cpe:2.3:a:wireshark:wireshark:2.4.1
  • Wireshark 2.4.2
    cpe:2.3:a:wireshark:wireshark:2.4.2
  • Wireshark 2.4.3
    cpe:2.3:a:wireshark:wireshark:2.4.3
  • Wireshark 2.4.4
    cpe:2.3:a:wireshark:wireshark:2.4.4
  • Wireshark 2.4.5
    cpe:2.3:a:wireshark:wireshark:2.4.5
  • Debian Linux 7.0
    cpe:2.3:o:debian:debian_linux:7.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
CVSS
Base: 5.0
Impact:
Exploitability:
CWE CWE-399
CAPEC
nessus via4
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1634.NASL
    description Several issues in wireshark, a tool that captures and analyzes packets off the wire, have been found by different people. These are basically issues with length checks or invalid memory access in different dissectors. This could result in infinite loops or crashes by malicious packets. For Debian 8 'Jessie', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u16. We recommend that you upgrade your wireshark packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-16
    plugin id 121193
    published 2019-01-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121193
    title Debian DLA-1634-1 : wireshark security update
  • NASL family Windows
    NASL id WIRESHARK_2_4_6.NASL
    description The version of Wireshark installed on the remote Windows host is 2.2.x prior to 2.2.14 or 2.4.x prior to 2.4.6. It is, therefore, affected by multiple vulnerabilities.
    last seen 2019-02-21
    modified 2018-08-08
    plugin id 108885
    published 2018-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108885
    title Wireshark 2.2.x < 2.2.14 / 2.4.x < 2.4.6 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1388.NASL
    description Several issues that could result in a crash within different dissectors have been fixed. Other issues are related to memory leaks or heap-based buffer overflows. All issue could be caused by special crafted and malformed packets. For Debian 7 'Wheezy', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6~deb7u11. We recommend that you upgrade your wireshark packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-31
    plugin id 110164
    published 2018-05-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110164
    title Debian DLA-1388-1 : wireshark security update
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-0981-1.NASL
    description This update for wireshark fixes the following issues : - Update to wireshark 2.2.14, fix such issues : - bsc#1088200 VUL-0: wireshark: multiple vulnerabilities fixed in 2.2.14, 2.4.6 - CVE-2018-9256: LWAPP dissector crash - CVE-2018-9260: IEEE 802.15.4 dissector crash - CVE-2018-9261: NBAP dissector crash - CVE-2018-9262: VLAN dissector crash - CVE-2018-9263: Kerberos dissector crash - CVE-2018-9264: ADB dissector crash - CVE-2018-9265: tn3270 dissector has a memory leak - CVE-2018-9266: ISUP dissector memory leak - CVE-2018-9267: LAPD dissector memory leak - CVE-2018-9268: SMB2 dissector memory leak - CVE-2018-9269: GIOP dissector memory leak - CVE-2018-9270: OIDS dissector memory leak - CVE-2018-9271: multipart dissector memory leak - CVE-2018-9272: h223 dissector memory leak - CVE-2018-9273: pcp dissector memory leak - CVE-2018-9274: failure message memory leak - CVE-2018-9259: MP4 dissector crash Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109198
    published 2018-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109198
    title SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2018:0981-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-0980-1.NASL
    description This update for wireshark fixes the following issues : - Update to wireshark 2.2.14, fix such issues : - bsc#1088200 VUL-0: wireshark: multiple vulnerabilities fixed in 2.2.14, 2.4.6 - CVE-2018-9256: LWAPP dissector crash - CVE-2018-9260: IEEE 802.15.4 dissector crash - CVE-2018-9261: NBAP dissector crash - CVE-2018-9262: VLAN dissector crash - CVE-2018-9263: Kerberos dissector crash - CVE-2018-9264: ADB dissector crash - CVE-2018-9265: tn3270 dissector has a memory leak - CVE-2018-9266: ISUP dissector memory leak - CVE-2018-9267: LAPD dissector memory leak - CVE-2018-9268: SMB2 dissector memory leak - CVE-2018-9269: GIOP dissector memory leak - CVE-2018-9270: OIDS dissector memory leak - CVE-2018-9271: multipart dissector memory leak - CVE-2018-9272: h223 dissector memory leak - CVE-2018-9273: pcp dissector memory leak - CVE-2018-9274: failure message memory leak - CVE-2018-9259: MP4 dissector crash Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 109197
    published 2018-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109197
    title SUSE SLES11 Security Update : wireshark (SUSE-SU-2018:0980-1)
  • NASL family MacOS X Local Security Checks
    NASL id MACOS_WIRESHARK_2_4_6.NASL
    description The version of Wireshark installed on the remote MacOS/MacOSX host is 2.2.x prior to 2.2.14 or 2.4.x prior to 2.4.6. It is, therefore, affected by multiple vulnerabilities.
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 108884
    published 2018-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108884
    title Wireshark 2.2.x < 2.2.14 / 2.4.x < 2.4.6 Multiple Vulnerabilities (MacOS)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2018-347.NASL
    description This update for wireshark fixes the following issues : Minor vulnerabilities that could be used to trigger dissector crashes or cause dissectors to go into large infinite loops by making Wireshark read specially crafted packages from the network or capture files (boo#1088200) : - CVE-2018-9264: ADB dissector crash - CVE-2018-9260: IEEE 802.15.4 dissector crash - CVE-2018-9261: NBAP dissector crash - CVE-2018-9262: VLAN dissector crash - CVE-2018-9256: LWAPP dissector crash - CVE-2018-9263: Kerberos dissector crash - CVE-2018-9259: MP4 dissector crash - Memory leaks in multiple dissectors: CVE-2018-9265, CVE-2018-9266, CVE-2018-9267, CVE-2018-9268, CVE-2018-9269, CVE-2018-9270, CVE-2018-9271, CVE-2018-9272, CVE-2018-9273, CVE-2018-9274 This update also contains all upstream bug fixes and updated protocol support as listed in : https://www.wireshark.org/docs/relnotes/wireshark-2.2.14.html
    last seen 2019-02-21
    modified 2018-09-04
    plugin id 108937
    published 2018-04-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108937
    title openSUSE Security Update : wireshark (openSUSE-2018-347)
refmap via4
misc
mlist
  • [debian-lts-announce] 20180528 [SECURITY] [DLA 1388-1] wireshark security update
  • [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
Last major update 04-04-2018 - 03:29
Published 04-04-2018 - 03:29
Last modified 27-02-2019 - 08:18
Back to Top