A flaw was found in Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. This was addressed in epan/tvbuff.c by rejecting negative lengths.
Created wireshark tracking bugs for this issue:
Affects: fedora-all [bug 1581754]
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):