Improper Handling of Missing Values in Wireshark

CVE-2024-0208

Summary

A vulnerability has been identified in multiple versions of Wireshark, specifically versions 4.2.0, as well as earlier versions starting from 3.6.0 up to 3.6.19, and from 4.0.0 up to 4.0.11. This issue is due to a crash in the GVCP dissector, which can be triggered through packet injection or the use of crafted capture files. Such manipulations may lead to a denial of service, which disrupts the operation of the application and can impact users' ability to analyze network traffic effectively. Immediate attention to updating to secure versions is recommended.

References