CVE-2023-0667

2023-06-0703:15:09

CWE-787

CWE-122

[email protected]

web.nvd.nist.gov

250

wireshark

cve-2023-0667

buffer overflow

security

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.002

Percentile

57.1%

JSON

Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark

Affected configurations

NVD

Node

wiresharkwiresharkRange4.0.0–4.0.6

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Wireshark",
    "vendor": "Wireshark Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.0.5",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.0.6"
      },
      {
        "lessThanOrEqual": "3.6.13",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "3.6.14"
      }
    ]
  }
]