Описание
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution
A flaw was found in Wireshark. Due to improper pathname validation during configuration profile imports, an attacker could convince a user to import a maliciously crafted profile. Successful exploitation could allow arbitrary code execution or cause an application crash, resulting in a Denial of Service (DoS).
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | wireshark | Fix deferred | ||
| Red Hat Enterprise Linux 6 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 7 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 8 | wireshark | Not affected | ||
| Red Hat Enterprise Linux 9 | wireshark | Not affected |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows deni ...
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution
Уязвимость функции WiresharkZipHelper::unzip() анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызывать отказ в обслуживании или выполнить произвольный код
5.5 Medium
CVSS3