CVE-2017-11410
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an...
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
- Record
CVE-2017-11410- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-20, CWE-835
- Updated
- 2026-11-02
CVE List No score
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
- Record
CVE-2017-11410- Updated
- 2026-11-02
EUVDEUVD-2017-3037 No score
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
- Record
EUVD-2017-3037- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x5hh-chcp-7jv5
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an...
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
- Record
GHSA-x5hh-chcp-7jv5- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
- Record
CVE-2017-11410- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-11410
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
- Record
DEBIAN-CVE-2017-11410- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-11410
In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.
- Record
UBUNTU-CVE-2017-11410- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0219 No score
Updated wireshark packages fix security vulnerabilities
The wireshark package has been updated to version 2.0.14, which fixes several security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details.
- Record
MGASA-2017-0219- Updated
- 2026-11-02
OSVMGASA-2017-0226 No score
Updated wireshark packages fix security vulnerabilities
The wireshark package has been updated to version 2.2.8, which fixes several security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details.
- Record
MGASA-2017-0226- Updated
- 2026-11-02
OSVSUSE-SU-2017:2032-1 No score
Security update for wireshark
This wireshark update to version 2.2.8 fixes the following issues:
Security issues fixed:
- CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. (bsc#1049621)
- CVE-2017-11410: The WBXML dissector could go into an infinite loop. (bsc#1049255)
- CVE-2017-11408: The AMQP dissector could crash. (bsc#1049255)
- CVE-2017-11407: The MQ dissector could crash. (bsc#1049255)
- CVE-2017-11406: The DOCSIS dissector could go into an infinite loop. (bsc#1049255)
- Record
SUSE-SU-2017:2032-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2033-1 No score
Security update for wireshark
This wireshark update to version 2.2.8 fixes the following issues:
Security issues fixed:
- CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. (bsc#1049621)
- CVE-2017-11410: The WBXML dissector could go into an infinite loop. (bsc#1049255)
- CVE-2017-11408: The AMQP dissector could crash. (bsc#1049255)
- CVE-2017-11407: The MQ dissector could crash. (bsc#1049255)
- CVE-2017-11406: The DOCSIS dissector could go into an infinite loop. (bsc#1049255)
- Record
SUSE-SU-2017:2033-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 2.4.0-1 | 2.4.0-1 |
wiresharkDebian:13 |
before 2.4.0-1 | 2.4.0-1 |
wiresharkDebian:14 |
before 2.4.0-1 | 2.4.0-1 |
wiresharkMageia:5 From an advisory covering 6 CVEs |
before 2.0.14-1.mga5 | 2.0.14-1.mga5 |
wiresharkMageia:6 From an advisory covering 5 CVEs |
before 2.2.8-1.mga6 | 2.2.8-1.mga6 |
wiresharkSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 5 CVEs |
before 2.0.14-40.7.1 | 2.0.14-40.7.1 |
wiresharkSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 5 CVEs |
before 2.0.14-40.7.1 | 2.0.14-40.7.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 5 CVEs |
before 2.0.14-40.7.1 | 2.0.14-40.7.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkUbuntu:14.04:LTS |
before 2.6.3-1~ubuntu14.04.1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-11.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 |
2.6.3-1~ubuntu14.04.1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.3-1~ubuntu16.04.1, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 |
2.6.3-1~ubuntu16.04.1 |
wiresharkUbuntu:18.04:LTS |
before 2.6.3-1~ubuntu18.04.1, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-1 |
2.6.3-1~ubuntu18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-11410 is a high vulnerability (CVSS 7.5) in Wireshark, published July 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. Fixed in wireshark 2.4.0-1.
References
bugs.wireshark.org/bugzilla/show_bug.cgi?id=13796
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=3c7168cc5f044b4da8747d35da0b2b204dabf398
wireshark.org/security/wnpa-sec-2017-13.html
nvd.nist.gov/vuln/detail/CVE-2017-11410
github.com/advisories/GHSA-x5hh-chcp-7jv5
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2017-11410
advisories.mageia.org/MGASA-2017-0219.html
bugs.mageia.org/show_bug.cgi?id=21315
suse.com/support/update/announcement/2017/suse-su-20172032-1
bugzilla.suse.com/1049255
ubuntu.com/security/CVE-2017-11410
cve.org/CVERecord?id=CVE-2017-11410