CVE-2013-2488

The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:wireshark:wireshark:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.8.2:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.8.3:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.8.4:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.8.5:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:wireshark:wireshark:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.3:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.4:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.5:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.6:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.7:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.8:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.9:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.10:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.11:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.12:*:*:*:*:*:*:*
cpe:2.3:a:wireshark:wireshark:1.6.13:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-03-07 15:55

Updated : 2024-02-04 18:16


NVD link : CVE-2013-2488

Mitre link : CVE-2013-2488

CVE.ORG link : CVE-2013-2488


JSON object : View

Products Affected

wireshark

  • wireshark

debian

  • debian_linux

opensuse

  • opensuse
CWE
CWE-20

Improper Input Validation