CVE-2018-19622 : In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go int

In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-mmse.c by preventing length overflows.

Published 2018-11-29 04:29:00

Updated 2020-03-20 01:15:21

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2018-19622

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Wireshark » Wireshark
Versions from including (>=) 2.6.0 and up to, including, (<=) 2.6.4
cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
Matching versions
Wireshark » Wireshark
Versions from including (>=) 2.4.0 and up to, including, (<=) 2.4.10
cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-19622

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 51 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-19622

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2018-19622

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-19622

https://www.oracle.com/security-alerts/cpuapr2020.html

Oracle Critical Patch Update Advisory - April 2020

CVEs referencing this url
https://www.debian.org/security/2018/dsa-4359

Debian -- Security Information -- DSA-4359-1 wireshark
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html

[security-announce] openSUSE-SU-2020:0362-1: moderate: Security update f

CVEs referencing this url
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3b7555d32d11862f0e500ec466ad6bfe54190076

code.wireshark Code Review - wireshark.git/commit
Mailing List;Patch;Vendor Advisory
http://www.securityfocus.com/bid/106051

Wireshark Multiple Denial of Service Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.wireshark.org/security/wnpa-sec-2018-54.html

Wireshark · wnpa-sec-2018-54 · MMSE dissector infinite loop
Vendor Advisory
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250

15250 – Buildbot crash output: fuzz-2018-10-30-17730.pcap
Exploit;Issue Tracking;Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00010.html

[SECURITY] [DLA 1634-1] wireshark security update
Mailing List;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-19622

Products affected by CVE-2018-19622

Exploit prediction scoring system (EPSS) score for CVE-2018-19622

CVSS scores for CVE-2018-19622

CWE ids for CVE-2018-19622

References for CVE-2018-19622