CVE-2017-11411

EUVD-2017-3038
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by adding length validation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-9350.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
Affected Products (NVD)
VendorProductVersion
wiresharkwireshark
2.0.0
wiresharkwireshark
2.0.1
wiresharkwireshark
2.0.2
wiresharkwireshark
2.0.3
wiresharkwireshark
2.0.4
wiresharkwireshark
2.0.5
wiresharkwireshark
2.0.6
wiresharkwireshark
2.0.7
wiresharkwireshark
2.0.8
wiresharkwireshark
2.0.9
wiresharkwireshark
2.0.10
wiresharkwireshark
2.0.11
wiresharkwireshark
2.0.12
wiresharkwireshark
2.0.13
wiresharkwireshark
2.2.0
wiresharkwireshark
2.2.1
wiresharkwireshark
2.2.2
wiresharkwireshark
2.2.3
wiresharkwireshark
2.2.4
wiresharkwireshark
2.2.5
wiresharkwireshark
2.2.6
wiresharkwireshark
2.2.7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
wireshark
bookworm
4.0.11-1~deb12u1
fixed
bookworm (security)
4.0.11-1~deb12u1
fixed
bullseye
3.4.10-0+deb11u1
fixed
bullseye (security)
3.4.16-0+deb11u1
fixed
jessie
not-affected
sid
4.4.1-1
fixed
stretch
not-affected
trixie
4.4.0-1
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
wireshark
artful
ignored
bionic
Fixed 2.6.3-1~ubuntu18.04.1
released
trusty
Fixed 2.6.3-1~ubuntu14.04.1
released
xenial
Fixed 2.6.3-1~ubuntu16.04.1
released
yakkety
ignored
zesty
ignored