CVE-2023-1992
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service...
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
- Record
CVE-2023-1992- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-24172
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
- Record
EUVD-2023-24172- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j3hh-fx42-vqq9
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service...
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
- Record
GHSA-j3hh-fx42-vqq9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
- Record
CVE-2023-1992- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
- Record
CVE-2023-1992- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-1992
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
- Record
DEBIAN-CVE-2023-1992- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2023-1260
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer. Wireshark, formerly known as Ethereal, can be used to examine the details of traffic at a variety of levels ranging from connection-level information to the bits that make up a single packet. Packet capture can provide a network administrator with information about individual packets such as transmit time, source, destination, protocol type and header data. This information can be useful for evaluating security events and troubleshooting network security device issues.
Security Fix(es):
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file(CVE-2023-1993)
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file(CVE-2023-1992)
GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file(CVE-2023-1994)
- Record
OESA-2023-1260- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1261
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer. Wireshark, formerly known as Ethereal, can be used to examine the details of traffic at a variety of levels ranging from connection-level information to the bits that make up a single packet. Packet capture can provide a network administrator with information about individual packets such as transmit time, source, destination, protocol type and header data. This information can be useful for evaluating security events and troubleshooting network security device issues.
Security Fix(es):
LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file(CVE-2023-1993)
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file(CVE-2023-1992)
GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file(CVE-2023-1994)
- Record
OESA-2023-1261- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-1992
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
- Record
UBUNTU-CVE-2023-1992- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12865-1 No score
libwireshark16-4.0.5-1.1 on GA media
These are all security issues fixed in the libwireshark16-4.0.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12865-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1931-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
- CVE-2023-1992: Fixed RPCoRDMA dissector crash (bsc#1210405).
- CVE-2023-1993: Fixed LISP dissector large loop (bsc#1210404).
- CVE-2023-1994: Fixed GQUIC dissector crash (bsc#1210403).
Update to 3.6.13:
- Further features, bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-3.6.13.html
- Record
SUSE-SU-2023:1931-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 4.0.6-1~deb12u1, plus listed versions 4.0.3-14.0.5-1~exp1 |
4.0.6-1~deb12u1 |
wiresharkDebian:13 |
before 4.0.6-1 | 4.0.6-1 |
wiresharkDebian:14 |
before 4.0.6-1 | 4.0.6-1 |
wiresharkDebian:10 From an advisory covering 4 CVEs |
before 2.6.20-0+deb10u6, plus listed versions 2.6.10-12.6.20-0+deb10u12.6.20-0+deb10u22.6.20-0+deb10u32.6.20-0+deb10u42.6.20-0+deb10u52.6.8-1.12.6.9-1 |
2.6.20-0+deb10u6 |
wiresharkDebian:11 From an advisory covering 47 CVEs |
before 3.4.16-0+deb11u1, plus listed versions 3.4.10-0+deb11u13.4.4-13.4.6-1~exp13.4.7-13.4.7-1~exp13.4.8-13.4.9-1 |
3.4.16-0+deb11u1 |
wiresharkDebian:12 From an advisory covering 14 CVEs |
before 4.0.6-1~deb12u1, plus listed versions 4.0.3-14.0.5-1~exp1 |
4.0.6-1~deb12u1 |
wiresharkopenEuler:22.03-LTS From an advisory covering 3 CVEs |
before 3.6.11-3.oe2203 | 3.6.11-3.oe2203 |
wiresharkopenEuler:22.03-LTS-SP1 From an advisory covering 3 CVEs |
before 3.6.11-3.oe2203sp1 | 3.6.11-3.oe2203sp1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Manager Proxy 4.2 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Manager Server 4.2 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Enterprise Storage 7 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkSUSE:Enterprise Storage 7.1 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkopenSUSE:Leap 15.4 From an advisory covering 3 CVEs |
before 3.6.13-150000.3.89.1 | 3.6.13-150000.3.89.1 |
wiresharkUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 9 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.02.6.8-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm22.6.10-1~ubuntu14.04.0~esm3 |
None known |
wiresharkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 8 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.02.6.8-1~ubuntu16.04.02.6.10-1~ubuntu16.04.02.6.10-1~ubuntu16.04.0+esm12.6.10-1~ubuntu16.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 Show 7 moreShow less2.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.02.6.8-1~ubuntu18.04.02.6.10-1~ubuntu18.04.02.6.10-1~ubuntu18.04.0+esm12.6.10-1~ubuntu18.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.5-13.0.7-13.2.1-13.2.2-13.2.3-13.2.3-1ubuntu0.1~esm13.2.3-1ubuntu0.1~esm2 |
None known |
wiresharkUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.4.7-1~exp13.4.9-13.6.2-1ubuntu13.6.2-23.6.2-2ubuntu0.1~esm1 |
None known |
wiresharkopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 4.0.5-1.1 | 4.0.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-1992 is a medium vulnerability (CVSS 6.3) in Wireshark, published April 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.62%, the 91st percentile. Fixed in wireshark 4.0.6-1~deb12u1.
References
wireshark.org/security/wnpa-sec-2023-09.html
gitlab.com/wireshark/wireshark/-/issues/18852
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT
Show 24 moreShow less
lists.debian.org/debian-lts-announce/2023/04/msg00029.html
debian.org/security/2023/dsa-5429
security.gentoo.org/glsa/202309-02
nvd.nist.gov/vuln/detail/CVE-2023-1992
github.com/advisories/GHSA-j3hh-fx42-vqq9
security-tracker.debian.org/tracker/CVE-2023-1992
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1260
suse.com/support/update/announcement/2023/suse-su-20231931-1
bugzilla.suse.com/1210403
ubuntu.com/security/CVE-2023-1992
cve.org/CVERecord?id=CVE-2023-1992