CVE-2018-14367
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was...
7.5 HighFix available
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
3.28%Up 1.8 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
- Record
CVE-2018-14367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-252
- Updated
- 2026-11-02
CVE List No score
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
- Record
CVE-2018-14367- Updated
- 2026-11-02
EUVDEUVD-2018-6288 No score
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
- Record
EUVD-2018-6288- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5426-cch2-9rw5
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was...
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
- Record
GHSA-5426-cch2-9rw5- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-252
- Updated
- 2026-11-02
OSV
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
- Record
CVE-2018-14367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-14367
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
- Record
DEBIAN-CVE-2018-14367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2018-14367
In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol dissector could crash. This was addressed in epan/dissectors/packet-coap.c by properly checking for a NULL condition.
- Record
UBUNTU-CVE-2018-14367- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0362-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0362-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2301-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Security issues fixed:
- CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, bsc#1101777)
- CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, bsc#1101788)
- CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, bsc#1101804)
- CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, bsc#1101786)
- CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, bsc#1101810)
- CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, bsc#1101776)
- CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, bsc#1101794)
- CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, bsc#1101800)
- CVE-2018-14367: CoAP dissector crash (wnpa-sec-2018-42, bsc#1101791)
- CVE-2018-14370: IEEE 802.11 dissector crash (wnpa-sec-2018-43, bsc#1101802)
Bug fixes:
- Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.4.8.html
- Record
SUSE-SU-2018:2301-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2412-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Security issues fixed:
- bsc#1094301: Wireshark security update to 2.6.1, 2.4.7, 2.2.15
- CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, bsc#1101810)
- CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, bsc#1101776)
- CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, bsc#1101786)
- CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, bsc#1101788)
- CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, bsc#1101804)
- CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, bsc#1101777)
- CVE-2018-14370: IEEE 802.11 dissector crash (wnpa-sec-2018-43, bsc#1101802)
- CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, bsc#1101800)
- CVE-2018-14367: CoAP dissector crash (wnpa-sec-2018-42, bsc#1101791)
- CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, bsc#1101794)
- CVE-2018-11355: Fix RTCP dissector crash (bsc#1094301).
- CVE-2018-11362: Fix LDSS dissector crash (bsc#1094301).
- CVE-2018-11361: Fix IEEE 802.11 dissector crash (bsc#1094301).
- CVE-2018-11360: Fix GSM A DTAP dissector crash (bsc#1094301).
- CVE-2018-11358: Fix Q.931 dissector crash (bsc#1094301).
- CVE-2018-11359: Fix multiple dissectors crashs (bsc#1094301).
- CVE-2018-11356: Fix DNS dissector crash (bsc#1094301).
- CVE-2018-11357: Fix multiple dissectors that could consume excessive memory (bsc#1094301).
- CVE-2018-11354: Fix IEEE 1905.1a dissector crash (bsc#1094301).
- Record
SUSE-SU-2018:2412-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2891-1 No score
Security update for wireshark
This update for wireshark to version 2.4.9 fixes the following issues:
Wireshark was updated to 2.4.9 (bsc#1094301, bsc#1106514).
Security issues fixed:
- CVE-2018-16058: Bluetooth AVDTP dissector crash (wnpa-sec-2018-44)
- CVE-2018-16056: Bluetooth Attribute Protocol dissector crash (wnpa-sec-2018-45)
- CVE-2018-16057: Radiotap dissector crash (wnpa-sec-2018-46)
- CVE-2018-11355: Fix RTCP dissector crash (bsc#1094301).
- CVE-2018-14370: IEEE 802.11 dissector crash (wnpa-sec-2018-43, bsc#1101802)
- CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, bsc#1101794)
- CVE-2018-11362: Fix LDSS dissector crash (bsc#1094301).
- CVE-2018-11361: Fix IEEE 802.11 dissector crash (bsc#1094301).
- CVE-2018-11360: Fix GSM A DTAP dissector crash (bsc#1094301).
- CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, bsc#1101777)
- CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, bsc#1101786)
- CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, bsc#1101804)
- CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, bsc#1101776)
- CVE-2018-11358: Fix Q.931 dissector crash (bsc#1094301).
- CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, bsc#1101788)
- CVE-2018-11359: Fix multiple dissectors crashs (bsc#1094301).
- CVE-2018-11356: Fix DNS dissector crash (bsc#1094301).
- CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, bsc#1101810)
- CVE-2018-11357: Fix multiple dissectors that could consume excessive memory (bsc#1094301).
- CVE-2018-14367: CoAP dissector crash (wnpa-sec-2018-42, bsc#1101791)
- CVE-2018-11354: Fix IEEE 1905.1a dissector crash (bsc#1094301).
- CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, bsc#1101800)
Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.4.9.html
- Record
SUSE-SU-2018:2891-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2891-2 No score
Security update for wireshark
This update for wireshark to version 2.4.9 fixes the following issues:
Wireshark was updated to 2.4.9 (bsc#1094301, bsc#1106514).
Security issues fixed:
- CVE-2018-16058: Bluetooth AVDTP dissector crash (wnpa-sec-2018-44)
- CVE-2018-16056: Bluetooth Attribute Protocol dissector crash (wnpa-sec-2018-45)
- CVE-2018-16057: Radiotap dissector crash (wnpa-sec-2018-46)
- CVE-2018-11355: Fix RTCP dissector crash (bsc#1094301).
- CVE-2018-14370: IEEE 802.11 dissector crash (wnpa-sec-2018-43, bsc#1101802)
- CVE-2018-14368: Bazaar dissector infinite loop (wnpa-sec-2018-40, bsc#1101794)
- CVE-2018-11362: Fix LDSS dissector crash (bsc#1094301).
- CVE-2018-11361: Fix IEEE 802.11 dissector crash (bsc#1094301).
- CVE-2018-11360: Fix GSM A DTAP dissector crash (bsc#1094301).
- CVE-2018-14342: BGP dissector large loop (wnpa-sec-2018-34, bsc#1101777)
- CVE-2018-14343: ASN.1 BER dissector crash (wnpa-sec-2018-37, bsc#1101786)
- CVE-2018-14340: Multiple dissectors could crash (wnpa-sec-2018-36, bsc#1101804)
- CVE-2018-14341: DICOM dissector crash (wnpa-sec-2018-39, bsc#1101776)
- CVE-2018-11358: Fix Q.931 dissector crash (bsc#1094301).
- CVE-2018-14344: ISMP dissector crash (wnpa-sec-2018-35, bsc#1101788)
- CVE-2018-11359: Fix multiple dissectors crashs (bsc#1094301).
- CVE-2018-11356: Fix DNS dissector crash (bsc#1094301).
- CVE-2018-14339: MMSE dissector infinite loop (wnpa-sec-2018-38, bsc#1101810)
- CVE-2018-11357: Fix multiple dissectors that could consume excessive memory (bsc#1094301).
- CVE-2018-14367: CoAP dissector crash (wnpa-sec-2018-42, bsc#1101791)
- CVE-2018-11354: Fix IEEE 1905.1a dissector crash (bsc#1094301).
- CVE-2018-14369: HTTP2 dissector crash (wnpa-sec-2018-41, bsc#1101800)
Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.4.9.html
- Record
SUSE-SU-2018:2891-2- Updated
- 2026-11-02
OSVSUSE-SU-2020:0693-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
- Record
SUSE-SU-2020:0693-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 2.6.2-1 | 2.6.2-1 |
wiresharkDebian:13 |
before 2.6.2-1 | 2.6.2-1 |
wiresharkDebian:14 |
before 2.6.2-1 | 2.6.2-1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 |
before 2.4.8-3.6.1 | 2.4.8-3.6.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 |
before 2.4.8-3.6.1 | 2.4.8-3.6.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.2.16-40.28.1 | 2.2.16-40.28.1 |
wiresharkSUSE:Linux Enterprise Server 11 SP4 |
before 2.2.16-40.28.1 | 2.2.16-40.28.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 2.2.16-40.28.1 | 2.2.16-40.28.1 |
wiresharkSUSE:OpenStack Cloud 7 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Server 12-LTSS |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP3 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Enterprise Storage 4 |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP2-BCL |
before 2.4.9-48.29.1 | 2.4.9-48.29.1 |
libmaxminddbSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
spandspSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server 15-LTSS |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server 15-LTSS |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server 15-LTSS |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server for SAP Applications 15 |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server for SAP Applications 15 |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
wiresharkUbuntu:14.04:LTS |
before 2.6.3-1~ubuntu14.04.1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-11.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 |
2.6.3-1~ubuntu14.04.1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.3-1~ubuntu16.04.1, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 |
2.6.3-1~ubuntu16.04.1 |
wiresharkUbuntu:18.04:LTS |
before 2.6.3-1~ubuntu18.04.1, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-1 |
2.6.3-1~ubuntu18.04.1 |
libmaxminddbopenSUSE:Leap 15.1 |
before 1.4.2-lp151.3.3.1 | 1.4.2-lp151.3.3.1 |
spandspopenSUSE:Leap 15.1 |
before 0.0.6-lp151.3.3.1 | 0.0.6-lp151.3.3.1 |
wiresharkopenSUSE:Leap 15.1 |
before 3.2.2-lp151.2.9.1 | 3.2.2-lp151.2.9.1 |
wiresharkopenSUSE:Tumbleweed |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14367 is a high vulnerability (CVSS 7.5) in Wireshark, published July 19, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in wireshark 2.6.2-1.
References
bugs.wireshark.org/bugzilla/show_bug.cgi?id=14966
securitytracker.com/id/1041608
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=81ce5fcb3e37a0aaeb7532f7a2a09366f16fa310
wireshark.org/security/wnpa-sec-2018-42.html
securityfocus.com/bid/104847
lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-14367
github.com/advisories/GHSA-5426-cch2-9rw5
security-tracker.debian.org/tracker/CVE-2018-14367
suse.com/support/update/announcement/2018/suse-su-20182301-1
bugzilla.suse.com/1101776
ubuntu.com/security/CVE-2018-14367
cve.org/CVERecord?id=CVE-2018-14367
This page doesn't list everything
Left out here: 15 references. The JSON record has them.