Improper input validation in Wireshark

CVE-2015-0563

epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.024 (82.6th percentile) — read the EPSS interpretation.

Affected products

  • Wireshark — versions 1.10.0, 1.10.1, 1.10.2
  • Opensuse — versions 13.1, 13.2
  • N/a — versions n/a

Weakness classification (CWE)

References