CVE-2022-3725 : Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial o

Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file

Published 2022-10-27 17:15:10

Updated 2023-10-20 17:51:27

Source GitLab Inc.

View at NVD, CVE.org

Vulnerability category: Memory CorruptionDenial of service

Products affected by CVE-2022-3725

Wireshark » Wireshark
Versions from including (>=) 3.6.0 and up to, including, (<=) 3.6.8
cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L	2.8	3.4	GitLab Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

https://gitlab.com/wireshark/wireshark/-/issues/18378

Stack Overflow Write - OPUS dissector - dissect_opus() frames (#18378) · Issues · Wireshark Foundation / wireshark · GitLab
Exploit;Patch;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIEIFFZ27YKCTK5C2VT4OEQSHPQDBNSF/

[SECURITY] Fedora 37 Update: wireshark-4.0.1-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://security.gentoo.org/glsa/202309-02

Wireshark: Multiple Vulnerabilities (GLSA 202309-02) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://www.wireshark.org/security/wnpa-sec-2022-07.html

Wireshark · wnpa-sec-2022-07 · OPUS dissector crash
Vendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3725.json

2022/CVE-2022-3725.json · master · GitLab.org / cves · GitLab
Third Party Advisory

Jump to