Log in Start free

Vulnerability · Published Aug 25, 2023 · Assigned by AHA

CVE-2023-2906Wireshark CP2179 divide by zero

Medium 6.5

In plain English

A medium-severity security flaw in Wireshark from Wireshark Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)2.8%top 13.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wireshark4.0.11-1~deb12u1DEBIAN-CVE-2023-2906
Debian:12wireshark4.0.11-1~deb12u1DSA-5559-1
Debian:13wireshark4.0.8-1DEBIAN-CVE-2023-2906
Debian:14wireshark4.0.8-1DEBIAN-CVE-2023-2906

Affected products (as reported)

VendorProductVersions
Wireshark Foundation Wireshark 2.0.0 – through 4.0.7

Weakness: CWE-369

References