Bug 2271741 (CVE-2024-2955)

Summary:	CVE-2024-2955 wireshark: T.38 dissector crash
Product:	[Other] Security Response	Reporter:	Rohit Keshri <rkeshri>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	wireshark 4.2.4, wireshark 4.0.14	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the T.38 dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a use-after-free problem, resulting in a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2273381
Bug Blocks:	2271742

Description Rohit Keshri 2024-03-27 07:54:31 UTC

T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file

https://gitlab.com/wireshark/wireshark/-/issues/19695
https://www.wireshark.org/security/wnpa-sec-2024-06.html

Comment 2 Guilherme de Almeida Suckevicz 2024-04-04 14:20:25 UTC

Created wireshark tracking bugs for this issue:

Affects: fedora-all [bug 2273381]