Vulnerability Details : CVE-2015-8726
wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Vulnerability category: OverflowInput validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2015-8726
Probability of exploitation activity in the next 30 days: 0.32%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 66 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-8726
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST |
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2015-8726
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-8726
-
http://www.securityfocus.com/bid/79382
Wireshark Multiple Security Vulnerabilities
-
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=185911de7d337246044c8e99da2f5b4bac74c0d5
code.wireshark Code Review - wireshark.git/commit
-
https://security.gentoo.org/glsa/201604-05
Wireshark: Multiple vulnerabilities (GLSA 201604-05) — Gentoo security
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11791
11791 – Wireshark stack-based out-of-bounds read in find_signature
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Oracle Solaris Bulletin - January 2016
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11789
11789 – Wireshark stack-based out-of-bounds read in getRate
-
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b8fa3d463c1bdd9b84c897441e7a5c8ad1f0f292
code.wireshark Code Review - wireshark.git/commit
-
http://www.wireshark.org/security/wnpa-sec-2015-44.html
Wireshark · wnpa-sec-2015-44 · VeriWave file parser crashesVendor Advisory
-
http://www.securitytracker.com/id/1034551
Wireshark Multiple Dissector/Parser Bugs Let Remote Users Deny Service - SecurityTracker
-
http://www.debian.org/security/2016/dsa-3505
Debian -- Security Information -- DSA-3505-1 wireshark
Products affected by CVE-2015-8726
- cpe:2.3:a:wireshark:wireshark:1.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.7:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:1.12.8:*:*:*:*:*:*:*
- cpe:2.3:a:wireshark:wireshark:2.0.0:*:*:*:*:*:*:*