Log in Start free

Vulnerability · Published Nov 16, 2023 · Assigned by GitLab

CVE-2023-6174Out-of-bounds Read in Wireshark

Medium 6.3

In plain English

A medium-severity out-of-bounds read in Wireshark from Wireshark Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.7%top 45.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20wireshark4.0.11-r0ALPINE-CVE-2023-6174
Alpine:v3.21wireshark4.0.11-r0ALPINE-CVE-2023-6174
Alpine:v3.22wireshark4.0.11-r0ALPINE-CVE-2023-6174
Alpine:v3.23wireshark4.0.11-r0ALPINE-CVE-2023-6174
Alpine:v3.24wireshark4.0.11-r0ALPINE-CVE-2023-6174
Debian:12wireshark4.0.11-1~deb12u1DEBIAN-CVE-2023-6174
Debian:12wireshark4.0.11-1~deb12u1DSA-5559-1
Debian:13wireshark4.0.11-1DEBIAN-CVE-2023-6174
Debian:14wireshark4.0.11-1DEBIAN-CVE-2023-6174
Ubuntu:24.04:LTSwireshark4.2.2-1.1build3UBUNTU-CVE-2023-6174

Affected products (as reported)

VendorProductVersions
Wireshark Foundation Wireshark 4.0.0 – before 4.0.11

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References