Improper input validation in Wireshark

CVE-2015-2187

The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.026 (83.9th percentile) — read the EPSS interpretation.

Affected products

  • Wireshark — versions 1.12.0, 1.12.1, 1.12.2
  • Opensuse — versions 13.1, 13.2
  • N/a — versions n/a

Weakness classification (CWE)

References