CVE-2016-5354

The USB subsystem in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles class types, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

References

Affected packages

Git / github.com/wireshark/wireshark

Affected ranges

Type

GIT

Repo

https://github.com/wireshark/wireshark

Events

Introduced

4fab41a1f0e14e9124ea6a61e7bae42e95599495

Last affected

eed34f0ac6696c053585ddf75c5805b3d5b395cf

Fixed

2cb5985bf47bdc8bea78d28483ed224abdd33dc6

Database specific

{
    "cpe": [
        "cpe:2.3:a:wireshark:wireshark:1.12.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:1.12.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:2.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:2.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:2.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:wireshark:wireshark:2.0.3:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.12.0"
        },
        {
            "last_affected": "1.12.0"
        },
        {
            "introduced": "1.12.1"
        },
        {
            "last_affected": "1.12.1"
        },
        {
            "introduced": "1.12.2"
        },
        {
            "last_affected": "1.12.2"
        },
        {
            "introduced": "1.12.3"
        },
        {
            "last_affected": "1.12.3"
        },
        {
            "introduced": "1.12.4"
        },
        {
            "last_affected": "1.12.4"
        },
        {
            "introduced": "1.12.5"
        },
        {
            "last_affected": "1.12.5"
        },
        {
            "introduced": "1.12.6"
        },
        {
            "last_affected": "1.12.6"
        },
        {
            "introduced": "1.12.7"
        },
        {
            "last_affected": "1.12.7"
        },
        {
            "introduced": "1.12.8"
        },
        {
            "last_affected": "1.12.8"
        },
        {
            "introduced": "1.12.9"
        },
        {
            "last_affected": "1.12.9"
        },
        {
            "introduced": "1.12.10"
        },
        {
            "last_affected": "1.12.10"
        },
        {
            "introduced": "1.12.11"
        },
        {
            "last_affected": "1.12.11"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        },
        {
            "introduced": "2.0.1"
        },
        {
            "last_affected": "2.0.1"
        },
        {
            "introduced": "2.0.2"
        },
        {
            "last_affected": "2.0.2"
        },
        {
            "introduced": "2.0.3"
        },
        {
            "last_affected": "2.0.3"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.12.0

1.12.1

1.12.10

1.12.11

1.12.2

1.12.3

1.12.4

1.12.5

1.12.6

1.12.7

1.12.8

1.12.9

2.*

2.0.0

2.0.1

2.0.2

2.0.3

Database specific

vanir_signatures_modified

"2026-07-08T12:05:03Z"

vanir_signatures

[
    {
        "target": {
            "function": "dissect_usb_video_control_interface_descriptor",
            "file": "epan/dissectors/packet-usb-video.c"
        },
        "id": "CVE-2016-5354-011723af",
        "digest": {
            "function_hash": "38991717562554354448688099878107430617",
            "length": 3472.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    },
    {
        "target": {
            "function": "dissect_usb_ms_bulk",
            "file": "epan/dissectors/packet-usb-masstorage.c"
        },
        "id": "CVE-2016-5354-3d8a4e2e",
        "digest": {
            "function_hash": "205275966524059301860662151854519004952",
            "length": 3916.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    },
    {
        "target": {
            "file": "epan/dissectors/packet-usb-masstorage.c"
        },
        "id": "CVE-2016-5354-75254fa7",
        "digest": {
            "line_hashes": [
                "104578399008033933484790114005483227338",
                "174835685048025130091216320107438523605",
                "166178389634764862862863190013939337808",
                "177389974860473702890910229842602741237",
                "238337483652338013289121849273947640311"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    },
    {
        "target": {
            "file": "epan/dissectors/packet-u3v.c"
        },
        "id": "CVE-2016-5354-a6662da7",
        "digest": {
            "line_hashes": [
                "28095717053133429533739427908533762268",
                "194535656081060019615570420065437164689",
                "285172571283529211920560151374617817753",
                "62737670386296213839126994697244632351"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    },
    {
        "target": {
            "file": "epan/dissectors/packet-usb.h"
        },
        "id": "CVE-2016-5354-b2859939",
        "digest": {
            "line_hashes": [
                "187611618679383657147187075697580540111",
                "35500140392874496190632268257813200513",
                "24909503819365022352672669174319515662",
                "88212867023447446693012239387813885709",
                "87801412849613835011788423419222158896",
                "143673356169114193494867804253258369242",
                "204154613662388597360739331540845914802"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    },
    {
        "target": {
            "file": "epan/dissectors/packet-usb-audio.c"
        },
        "id": "CVE-2016-5354-ba211bdf",
        "digest": {
            "line_hashes": [
                "186543461634473554635284614606606556443",
                "65316368528136380644700311899371356510",
                "102212498408069995683177291519526333446",
                "252577905139853126889246322500453426014"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    },
    {
        "target": {
            "function": "dissect_u3v",
            "file": "epan/dissectors/packet-u3v.c"
        },
        "id": "CVE-2016-5354-c952d4fb",
        "digest": {
            "function_hash": "179716100385531890219293716583623713296",
            "length": 5066.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    },
    {
        "target": {
            "file": "epan/dissectors/packet-usb-video.c"
        },
        "id": "CVE-2016-5354-ef2f4e0b",
        "digest": {
            "line_hashes": [
                "66969777042917715605213464713518031072",
                "231957956600622192529325516774099401315",
                "58485873746455648256178749521583511809",
                "251463345109567976779019212207360989530"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5354.json"

Git / gitlab.com/wireshark/wireshark