Описание
ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
A flaw was found in Wireshark. A remote attacker could exploit a buffer over-read vulnerability in the ERF (Extensible Record Format) file parser. This could lead to a denial of service, making the application unavailable to legitimate users.
Отчет
Red Hat Enterprise Linux 6 through 9 ship Wireshark versions 1.x through 3.x, which predate the introduction of the vulnerable code in version 4.4.0 and are therefore not affected by this flaw. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS ship Wireshark 4.4.2, which is within the affected range (4.4.0–4.4.17).
Меры по смягчению последствий
Avoid opening ERF (Extensible Record Format) capture files from untrusted or unknown sources in Wireshark.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | wireshark | Fix deferred | ||
| Red Hat Enterprise Linux 6 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 7 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 8 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 9 | wireshark | Not affected |
Показывать по
Дополнительная информация
Статус:
3.3 Low
CVSS3
Связанные уязвимости
ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows den ...
ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
3.3 Low
CVSS3