Vulnerability Details : CVE-2019-5721
Potential exploit
In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by changing the memory-management approach so that a use-after-free is avoided.
Vulnerability category: Memory Corruption
Products affected by CVE-2019-5721
- cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-5721
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-5721
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST | |
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2019-5721
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-5721
-
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
[security-announce] openSUSE-SU-2020:0362-1: moderate: Security update f
-
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=1c66174ec7aa19e2ddc79178cf59f15a654fc4fe
code.wireshark Code Review - wireshark.git/commitPatch;Vendor Advisory
-
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14470
14470 – Crafted CIP packets causes heap-use-after-freeIssue Tracking;Exploit;Vendor Advisory
-
https://www.wireshark.org/security/wnpa-sec-2019-05.html
Wireshark · wnpa-sec-2019-05 · ENIP dissector crashVendor Advisory
Jump to