PT-2023-16439 · Wireshark+3 · Wireshark+3

Wanderingglitch + 1 · Published 2023-06-04 · Updated 2025-01-06 · CVE-2023-0667

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.0.5 and prior

Description The issue arises from a failure to validate the length of an attacker-crafted MSMMS packet, leading to a heap-based buffer overflow. This could result in code execution within the context of the process running the affected software. The issue is particularly relevant in unusual configurations.

Recommendations For Wireshark versions 4.0.5 and prior, update to a version that addresses this issue to prevent potential heap-based buffer overflow and code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

ALT-PU-2023-1938

ALT-PU-2023-1971

ALT-PU-2023-1976

ALT-PU-2023-5823

ALT-PU-2023-6556

AZL-27144

CVE-2023-0667

DLA-3906-1

DSA-5429-1

OESA-2023-1363

OESA-2023-1371

OESA-2023-1372

OESA-2023-1373

OESA-2023-1374

OPENSUSE-SU-2023_3252-1

OPENSUSE-SU-2024:13014-1

ROSA-SA-2024-2388

SUSE-SU-2023:3252-1

SUSE-SU-2023_3252-1

Affected Products

Alt Linux

Astra Linux

Suse

Wireshark

References · 48

• 🔥 https://gitlab.com/wireshark/wireshark/-/issues/19086 · Exploit
• 🔥 https://takeonme.org/cves/CVE-2023-0667.html · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:13014-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0667 · Security Note
• https://ubuntu.com/security/CVE-2023-0667 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1372 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5429-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1371 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0667 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27144 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3906-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1374 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-0667 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-0667 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:3252-1 · Vendor Advisory