Описание
Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
A flaw was found in Wireshark. A path traversal can occur when a malformed configuration profile is imported, resulting in a denial of service or potentially in code execution.
Отчет
This issue will cause a crash in Wireshark and potentially result in code execution. This flaw can only be exploited when a malformed configuration profile is imported. Due to these reasons, this vulnerability has been rated with an important severity.
Меры по смягчению последствий
To mitigate this flaw, do not import configuration profiles from untrusted or unverified sources.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 7 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 8 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 9 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 10 | wireshark | Fixed | RHSA-2026:20600 | 26.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | wireshark | Fixed | RHSA-2026:26182 | 16.06.2026 |
Показывать по
Дополнительная информация
Статус:
7.8 High
CVSS3
Связанные уязвимости
Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to ...
Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
Уязвимость функции WiresharkZipHelper::unzip() профиля конфигурации анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызывать отказ в обслуживании или выполнить произвольный код
7.8 High
CVSS3