Bug 2280715 (CVE-2024-4854) - CVE-2024-4854 wireshark: MONGO and ZigBee TLV dissector infinite loops
Summary: CVE-2024-4854 wireshark: MONGO and ZigBee TLV dissector infinite loops
Keywords:
Status: NEW
Alias: CVE-2024-4854
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2280716
Blocks: 2280710
TreeView+ depends on / blocked
 
Reported: 2024-05-15 22:00 UTC by Nick Tait
Modified: 2024-05-23 13:19 UTC (History)
0 users

Fixed In Version: wireshark 4.2.5, wireshark 4.0.15, wireshark 3.6.23
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Nick Tait 2024-05-15 22:00:41 UTC 
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

https://gitlab.com/wireshark/wireshark/-/issues/19726
https://gitlab.com/wireshark/wireshark/-/merge_requests/15047
https://gitlab.com/wireshark/wireshark/-/merge_requests/15499
https://www.wireshark.org/security/wnpa-sec-2024-07.html
Comment 1 Nick Tait 2024-05-15 22:01:22 UTC 
Created wireshark tracking bugs for this issue:

Affects: fedora-all [bug 2280716]
Note You need to log in before you can comment on or make changes to this bug.