CVE-2011-4102

Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file...

4.3 MediumFix available

Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file.

Exploit likelihood

3.18%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2011-4102
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-4102
Updated: 2026-11-02

EUVDEUVD-2011-4053 No score

Record: EUVD-2011-4053
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r3wc-v5w3-cx98 No score

Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file...

Record: GHSA-r3wc-v5w3-cx98
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Record: CVE-2011-4102
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-4102 No score

Record: DEBIAN-CVE-2011-4102
Updated: 2026-11-02

Affected products

wireshark

Affected packages

Affected packages
Package	Affected	Fixed
`wireshark` Debian:12	before 1.6.3-1	1.6.3-1
`wireshark` Debian:13	before 1.6.3-1	1.6.3-1
`wireshark` Debian:14	before 1.6.3-1	1.6.3-1
`wireshark` Debian:6.0	before 1.2.11-6+squeeze5, plus listed versions 1.2.11-61.2.11-6+squeeze11.2.11-6+squeeze21.2.11-6+squeeze4	1.2.11-6+squeeze5
`wireshark` Debian:5.0	before 1.0.2-3+lenny16, plus listed versions 1.0.2-3+lenny101.0.2-3+lenny111.0.2-3+lenny121.0.2-3+lenny131.0.2-3+lenny14 Show 8 moreShow less 1.0.2-3+lenny151.0.2-3+lenny31.0.2-3+lenny41.0.2-3+lenny51.0.2-3+lenny61.0.2-3+lenny71.0.2-3+lenny81.0.2-3+lenny9	1.0.2-3+lenny16
`wireshark` Red Hat:enterprise_linux:6::client From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-debuginfo` Red Hat:enterprise_linux:6::client From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-devel` Red Hat:enterprise_linux:6::client From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-gnome` Red Hat:enterprise_linux:6::client From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark` Red Hat:enterprise_linux:6::server From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1

Show 15 moreShow less

Affected packages
Package	Affected	Fixed
`wireshark-debuginfo` Red Hat:enterprise_linux:6::server From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-devel` Red Hat:enterprise_linux:6::server From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-gnome` Red Hat:enterprise_linux:6::server From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark` Red Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-debuginfo` Red Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-devel` Red Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark-gnome` Red Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs	before 0:1.2.15-2.el6_2.1	0:1.2.15-2.el6_2.1
`wireshark` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5
`wireshark-debuginfo` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5
`wireshark-gnome` Red Hat:enterprise_linux:5::client_workstation From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5
`wireshark` Red Hat:enterprise_linux:5::client From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5
`wireshark-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5
`wireshark` Red Hat:enterprise_linux:5::server From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5
`wireshark-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5
`wireshark-gnome` Red Hat:enterprise_linux:5::server From an advisory covering 13 CVEs	before 0:1.0.15-5.el5	0:1.0.15-5.el5

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4102 is a medium vulnerability (CVSS 4.3) in Wireshark, published November 3, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.18%, the 88th percentile. Fixed in wireshark 1.6.3-1.

References

Show 93 moreShow less