SecuriTricks - CVE-2024-4854

Description

MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

Product(s) Impacted

Product	Versions
Wireshark	4.2.0 - 4.2.4 4.0.0 - 4.0.14 3.6.0 - 3.6.22

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://gitlab.com/wireshark/wireshark/-/issues/19726

https://gitlab.com/wireshark/wireshark/-/merge_requests/15047

https://gitlab.com/wireshark/wireshark/-/merge_requests/15499

https://www.wireshark.org/security/wnpa-sec-2024-07.html

CVSS Score

6.4 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

View Vector String

Timeline

Published: May 14, 2024, 3:45 p.m.
Last Modified: May 14, 2024, 4:11 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@gitlab.com

CVE-2024-4854