CVE-2017-7701

EUVD-2017-16677
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-bgp.c by using a different integer data type.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
Affected Products (NVD)
VendorProductVersion
wiresharkwireshark
2.0.0
wiresharkwireshark
2.0.1
wiresharkwireshark
2.0.2
wiresharkwireshark
2.0.3
wiresharkwireshark
2.0.4
wiresharkwireshark
2.0.5
wiresharkwireshark
2.0.6
wiresharkwireshark
2.0.7
wiresharkwireshark
2.0.8
wiresharkwireshark
2.0.9
wiresharkwireshark
2.0.10
wiresharkwireshark
2.0.11
wiresharkwireshark
2.2.0
wiresharkwireshark
2.2.1
wiresharkwireshark
2.2.2
wiresharkwireshark
2.2.3
wiresharkwireshark
2.2.4
wiresharkwireshark
2.2.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
wireshark
bookworm
4.0.11-1~deb12u1
fixed
bookworm (security)
4.0.11-1~deb12u1
fixed
bullseye
3.4.10-0+deb11u1
fixed
bullseye (security)
3.4.16-0+deb11u1
fixed
jessie
not-affected
sid
4.4.1-1
fixed
trixie
4.4.0-1
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
wireshark
artful
Fixed 2.2.6+g32dac6a-2
released
bionic
Fixed 2.6.3-1~ubuntu18.04.1
released
precise
ignored
trusty
Fixed 2.6.3-1~ubuntu14.04.1
released
xenial
Fixed 2.6.3-1~ubuntu16.04.1
released
yakkety
Fixed 2.2.6+g32dac6a-2ubuntu0.16.10
released
zesty
Fixed 2.2.6+g32dac6a-2ubuntu0.17.04
released
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/97632
http://www.securitytracker.com/id/1038262
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13557
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=fa31f69b407436d0946f84baa0acdcc50962bf7a
https://security.gentoo.org/glsa/201706-12
https://www.wireshark.org/security/wnpa-sec-2017-16.html
http://www.securityfocus.com/bid/97632
http://www.securitytracker.com/id/1038262
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13557
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=fa31f69b407436d0946f84baa0acdcc50962bf7a
https://security.gentoo.org/glsa/201706-12
https://www.wireshark.org/security/wnpa-sec-2017-16.html