CVE-2010-0304
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0...
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
Exploit likelihood
What each source reports
NVD Score used
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
- Record
CVE-2010-0304- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
- Record
CVE-2010-0304- Updated
- 2026-11-02
EUVDEUVD-2010-0335 No score
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
- Record
EUVD-2010-0335- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jpr3-gg36-wv7f No score
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0...
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
- Record
GHSA-jpr3-gg36-wv7f- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
- Record
CVE-2010-0304- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-0304 No score
Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
- Record
DEBIAN-CVE-2010-0304- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 1.2.6-1 | 1.2.6-1 |
wiresharkDebian:13 |
before 1.2.6-1 | 1.2.6-1 |
wiresharkDebian:14 |
before 1.2.6-1 | 1.2.6-1 |
wiresharkDebian:5.0 From an advisory covering 2 CVEs |
before 1.0.2-3+lenny8, plus listed versions 1.0.2-3+lenny31.0.2-3+lenny41.0.2-3+lenny51.0.2-3+lenny61.0.2-3+lenny7 |
1.0.2-3+lenny8 |
wiresharkRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-gnomeRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wiresharkRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-gnomeRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-gnomeRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wiresharkRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wireshark-gnomeRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs |
before 0:1.0.11-EL3.6 | 0:1.0.11-EL3.6 |
wiresharkRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-gnomeRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wiresharkRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-gnomeRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wiresharkRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-gnomeRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wiresharkRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wireshark-gnomeRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs |
before 0:1.0.11-1.el4_8.5 | 0:1.0.11-1.el4_8.5 |
wiresharkRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
wireshark-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
wireshark-gnomeRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
wiresharkRed Hat:enterprise_linux:5::client From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
wireshark-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
wiresharkRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
wireshark-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
wireshark-gnomeRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs |
before 0:1.0.11-1.el5_5.5 | 0:1.0.11-1.el5_5.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow | 2010-01-27 |
| Metasploit | Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow (loop) | 2010-01-27 |
| Exploit-DB | Wireshark 1.2.5 - 'LWRES getaddrbyname' Stack Buffer Overflow (PoC) | 2010-01-29 |
| Exploit-DB | Wireshark - LWRES Dissector getaddrsbyname_request Buffer Overflow (Metasploit) | 2010-02-11 |
| Exploit-DB | Wireshark - LWRES Dissector getaddrsbyname_request Buffer Overflow (Loop) (Metasploit) | 2010-11-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0304 is a high vulnerability (CVSS 7.5) in Wireshark, published January 30, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.1%, the 99th percentile. Fixed in wireshark 1.2.6-1.
References
debian.org/security/2010/dsa-1983
wireshark.org/security/wnpa-sec-2010-02.html
openwall.com/lists/oss-security/2010/01/29/4
metasploit.com/modules/exploit/multi/misc/wireshark_lwres_getaddrbyname
secunia.com/advisories/38348
Show 47 moreShow less
securityfocus.com/bid/37985
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9933
osvdb.org/61987
vupen.com/english/advisories/2010/0239
anonsvn.wireshark.org/viewvc/trunk-1.2/epan/dissectors/packet-lwres.c?view=diff&r1=31596&r2=28492&diff_format=h
securitytracker.com/id?1023516
mandriva.com/security/advisories?name=MDVSA-2010:031
exchange.xforce.ibmcloud.com/vulnerabilities/55951
lists.fedoraproject.org/pipermail/package-announce/2010-March/036415.html
nvd.nist.gov/vuln/detail/CVE-2010-0304
github.com/advisories/GHSA-jpr3-gg36-wv7f
security-tracker.debian.org/tracker/CVE-2010-0304
access.redhat.com/errata/RHSA-2010:0360
bugzilla.redhat.com/show_bug.cgi?id=512987
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0360.json
cve.org/CVERecord?id=CVE-2009-2560