CVE-2018-11357

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-11357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-11357
Related
Published
2018-05-22T21:29:00Z
Modified
2024-09-18T02:59:01.143076Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.

References

Affected packages

Alpine:v3.5 / wireshark

Package

Name
wireshark
Purl
pkg:apk/alpine/wireshark?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.15-r0

Affected versions

1.*

1.2.1-r0
1.2.2-r0
1.2.4-r0
1.2.6-r0
1.2.6-r1
1.2.6-r2
1.2.8-r0
1.2.9-r0
1.2.10-r0
1.4.0-r0
1.4.1-r0
1.4.2-r0
1.4.3-r0
1.4.4-r0
1.4.5-r0
1.4.6-r0
1.4.7-r0
1.6.0-r0
1.6.0-r1
1.6.1-r0
1.6.2-r0
1.6.3-r0
1.6.4-r0
1.6.5-r0
1.6.6-r0
1.6.6-r1
1.6.8-r0
1.6.8-r1
1.8.1-r0
1.8.2-r0
1.8.3-r0
1.8.4-r0
1.8.5-r0
1.8.6-r0
1.8.7-r0
1.10.0-r0
1.10.1-r0
1.10.2-r0
1.10.2-r1
1.10.3-r0
1.10.3-r1
1.10.4-r0
1.10.5-r0
1.10.5-r1
1.10.6-r0
1.10.7-r0
1.10.8-r0
1.12.0-r0
1.12.0-r1
1.12.1-r0
1.12.1-r1
1.12.2-r0
1.12.3-r0
1.12.4-r0
1.12.4-r1
1.12.5-r0
1.12.7-r0
1.12.8-r0

2.*

2.0.0-r0
2.0.1-r0
2.0.2-r0
2.0.3-r0
2.0.4-r0
2.0.5-r0
2.2.0-r0
2.2.0-r1
2.2.2-r0
2.2.3-r0
2.2.4-r0
2.2.4-r1
2.2.5-r0
2.2.6-r0
2.2.7-r0
2.2.8-r0
2.2.10-r0
2.2.11-r0
2.2.12-r0
2.2.14-r0

Debian:11 / wireshark

Package

Name
wireshark
Purl
pkg:deb/debian/wireshark?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / wireshark

Package

Name
wireshark
Purl
pkg:deb/debian/wireshark?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / wireshark

Package

Name
wireshark
Purl
pkg:deb/debian/wireshark?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/wireshark/wireshark

Affected ranges

Type
GIT
Repo
https://github.com/wireshark/wireshark
Events
Introduced
5368c50be46d4a44986d12bdfc0a35b42c0f34fc
Last affected
9c7f2bad2cb92655371dabe5b3c3cc3070dfe4cc
Last affected
c7239f0201292253817c7c4c9a394a47113ca55c
Introduced
9be0fa500da594ed01baf3214642838d22811c90
Last affected
e2f395aa12bfb9572bc509145234ee0d31ad82f2

Affected versions

2.*

2.2.1rc0

v2.*

v2.2.0
v2.2.1
v2.2.10
v2.2.10rc0
v2.2.11
v2.2.11rc0
v2.2.12
v2.2.12rc0
v2.2.13
v2.2.13rc0
v2.2.14
v2.2.14rc0
v2.2.1rc0
v2.2.2
v2.2.2rc0
v2.2.3
v2.2.3rc0
v2.2.4
v2.2.4rc0
v2.2.5
v2.2.5rc0
v2.2.6
v2.2.6rc0
v2.2.7
v2.2.7rc0
v2.2.8
v2.2.8rc0
v2.2.9
v2.2.9rc0
v2.4.0
v2.4.1
v2.4.1rc0
v2.4.2
v2.4.2rc0
v2.4.3
v2.4.3rc0
v2.4.4
v2.4.4rc0
v2.4.5
v2.4.5rc0
v2.4.6
v2.4.6rc0

wireshark-2.*

wireshark-2.2.0
wireshark-2.2.1
wireshark-2.2.10
wireshark-2.2.11
wireshark-2.2.12
wireshark-2.2.13
wireshark-2.2.14
wireshark-2.2.2
wireshark-2.2.3
wireshark-2.2.4
wireshark-2.2.5
wireshark-2.2.6
wireshark-2.2.7
wireshark-2.2.8
wireshark-2.2.9
wireshark-2.4.0
wireshark-2.4.1
wireshark-2.4.2
wireshark-2.4.3
wireshark-2.4.4
wireshark-2.4.5
wireshark-2.4.6