CVE-2023-0667
07.06.2023, 03:15
Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running WiresharkEnginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| wireshark | wireshark | 4.0.0 ≤ 𝑥 < 4.0.6 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libwireshark15 |
| ||||||||||||||||||||||||
| libwireshark17 |
| ||||||||||||||||||||||||
| libwiretap12 |
| ||||||||||||||||||||||||
| libwiretap14 |
| ||||||||||||||||||||||||
| libwsutil13 |
| ||||||||||||||||||||||||
| libwsutil15 |
| ||||||||||||||||||||||||
| wireshark |
| ||||||||||||||||||||||||
| wireshark-devel |
| ||||||||||||||||||||||||
| wireshark-ui-qt |
|
Common Weakness Enumeration
- CWE-122 - Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
- CWE-787 - Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.
References