Uncontrolled Recursion in Wireshark
CVE-2023-4512

7.5HIGH

Key Information:

Vendor
Wireshark
Status
Wireshark
Vendor
CVE Published:
24 August 2023

Summary

The CBOR dissector in Wireshark versions 4.0.0 through 4.0.6 is subject to a vulnerability that can lead to a denial of service. This is achieved through packet injection or the use of a specially crafted capture file, which causes the application to crash. Users of these versions should promptly update to mitigate the risks associated with this vulnerability.

Affected Version(s)

Wireshark 4.0.0 < 4.0.8

References

https://www.wireshark.org/security/wnpa-sec-2023-23.html
https://gitlab.com/wireshark/wireshark/-/issues/19144
issue-tracking

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Simone Di Maria
.