CVE-2018-18227
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This...
7.5 HighFix available
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
3.18%Up 1.3 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
- Record
CVE-2018-18227- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
- Record
CVE-2018-18227- Updated
- 2026-11-02
EUVDEUVD-2018-9964 No score
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
- Record
EUVD-2018-9964- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ffg3-hh5q-jq5v
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This...
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
- Record
GHSA-ffg3-hh5q-jq5v- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
- Record
CVE-2018-18227- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-18227
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
- Record
DEBIAN-CVE-2018-18227- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2018-18227
In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values.
- Record
UBUNTU-CVE-2018-18227- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0362-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0362-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3282-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Wireshark was updated to 2.4.10 (bsc#1111647).
Following security issues were fixed:
- CVE-2018-18227: MS-WSP dissector crash (wnpa-sec-2018-47)
- CVE-2018-12086: OpcUA dissector crash (wnpa-sec-2018-50)
Further bug fixes and updated protocol support that were done are listed in:
https://www.wireshark.org/docs/relnotes/wireshark-2.4.10.html
- Record
SUSE-SU-2018:3282-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3590-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Wireshark was updated to 2.4.10 (bsc#1111647).
Following security issues were fixed:
- CVE-2018-18227: MS-WSP dissector crash (wnpa-sec-2018-47)
- CVE-2018-12086: OpcUA dissector crash (wnpa-sec-2018-50)
Further bug fixes and updated protocol support that were done are listed in:
https://www.wireshark.org/docs/relnotes/wireshark-2.4.10.html
- Record
SUSE-SU-2018:3590-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3590-2 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Wireshark was updated to 2.4.10 (bsc#1111647).
Following security issues were fixed:
- CVE-2018-18227: MS-WSP dissector crash (wnpa-sec-2018-47)
- CVE-2018-12086: OpcUA dissector crash (wnpa-sec-2018-50)
Further bug fixes and updated protocol support that were done are listed in:
https://www.wireshark.org/docs/relnotes/wireshark-2.4.10.html
- Record
SUSE-SU-2018:3590-2- Updated
- 2026-11-02
OSVSUSE-SU-2018:3590-3 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Wireshark was updated to 2.4.10 (bsc#1111647).
Following security issues were fixed:
- CVE-2018-18227: MS-WSP dissector crash (wnpa-sec-2018-47)
- CVE-2018-12086: OpcUA dissector crash (wnpa-sec-2018-50)
Further bug fixes and updated protocol support that were done are listed in:
https://www.wireshark.org/docs/relnotes/wireshark-2.4.10.html
- Record
SUSE-SU-2018:3590-3- Updated
- 2026-11-02
OSVSUSE-SU-2020:0693-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
- Record
SUSE-SU-2020:0693-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 2.6.4-1 | 2.6.4-1 |
wiresharkDebian:13 |
before 2.6.4-1 | 2.6.4-1 |
wiresharkDebian:14 |
before 2.6.4-1 | 2.6.4-1 |
wiresharkDebian:9 From an advisory covering 11 CVEs |
before 2.6.5-1~deb9u1, plus listed versions 2.2.6+g32dac6a-22.2.6+g32dac6a-2+deb9u12.2.6+g32dac6a-2+deb9u22.2.6+g32dac6a-2+deb9u32.2.7-1 Show 14 moreShow less2.4.0-12.4.1-12.4.2-12.4.3-12.4.4-12.4.5-12.4.6-12.6.1-12.6.2-12.6.2-22.6.3-12.6.3-1~deb9u12.6.4-12.6.4-2 |
2.6.5-1~deb9u1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 2 CVEs |
before 2.4.10-3.12.2 | 2.4.10-3.12.2 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 2 CVEs |
before 2.4.10-3.12.2 | 2.4.10-3.12.2 |
wiresharkSUSE:OpenStack Cloud 7 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkSUSE:Linux Enterprise Server 12-LTSS From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Enterprise Storage 4 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 2 CVEs |
before 2.4.10-48.32.1 | 2.4.10-48.32.1 |
libmaxminddbSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
spandspSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
wiresharkUbuntu:14.04:LTS |
before 2.6.4-2~ubuntu14.04.1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-11.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.1 |
2.6.4-2~ubuntu14.04.1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.4-2~ubuntu16.04.0, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.042.6.3-1~ubuntu16.04.1 |
2.6.4-2~ubuntu16.04.0 |
wiresharkUbuntu:18.04:LTS |
before 2.6.4-2~ubuntu18.04.0, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 |
2.6.4-2~ubuntu18.04.0 |
libmaxminddbopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 1.4.2-lp151.3.3.1 | 1.4.2-lp151.3.3.1 |
spandspopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 0.0.6-lp151.3.3.1 | 0.0.6-lp151.3.3.1 |
wiresharkopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 3.2.2-lp151.2.9.1 | 3.2.2-lp151.2.9.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-18227 is a high vulnerability (CVSS 7.5) in Wireshark, published October 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.18%, the 88th percentile. Fixed in wireshark 2.6.4-1.
References
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15119
wireshark.org/security/wnpa-sec-2018-47.html
securitytracker.com/id/1041909
securityfocus.com/bid/105583
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=d443be449a52f95df5754adc39e1f3472fec2f03
debian.org/security/2018/dsa-4359
Show 194 moreShow less
lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
oracle.com/security-alerts/cpuapr2020.html
nvd.nist.gov/vuln/detail/CVE-2018-18227
github.com/advisories/GHSA-ffg3-hh5q-jq5v
security-tracker.debian.org/tracker/CVE-2018-18227
suse.com/support/update/announcement/2018/suse-su-20183282-1
bugzilla.suse.com/1111647
ubuntu.com/security/CVE-2018-18227
cve.org/CVERecord?id=CVE-2018-18227
This page doesn't list everything
Left out here: 17 references. The JSON record has them.