CVE-2023-4513
Missing Release of Memory after Effective Lifetime in Wireshark
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Missing Release of Memory after Effective Lifetime in Wireshark
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
- Record
CVE-2023-4513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
EUVDEUVD-2023-54368
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
- Record
EUVD-2023-54368- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m8r8-3226-6wp8
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of...
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
- Record
GHSA-m8r8-3226-6wp8- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
NVD
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
- Record
CVE-2023-4513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSV
Missing Release of Memory after Effective Lifetime in Wireshark
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
- Record
CVE-2023-4513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-4513
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
- Record
DEBIAN-CVE-2023-4513- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2023-1652
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.
Security Fix(es):
Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack. (CVE-2023-2906)
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file(CVE-2023-3649)
BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file(CVE-2023-4511)
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file(CVE-2023-4513)
- Record
OESA-2023-1652- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-4513
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
- Record
UBUNTU-CVE-2023-4513- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2023-0275 No score
Updated wireshark packages fix security vulnerabilities
The updated wireshark packages fix security vulnerabilities:
Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack. (CVE-2023-2906)
BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file. (CVE-2023-4511)
CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file. (CVE-2023-4512)
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file. (CVE-2023-4513)
- Record
MGASA-2023-0275- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13184-1 No score
libwireshark16-4.0.8-2.1 on GA media
These are all security issues fixed in the libwireshark16-4.0.8-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13184-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:3778-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
- Wireshark update to v3.6.16.
- CVE-2023-4512: Fixed a bug in CBOR dissector which could lead to crash. (bsc#1214561)
- CVE-2023-4511: Fixed a bug in BT SDP dissector which could lead to an infinite loop. (bsc#1214560)
- CVE-2023-4513: Fixed a bug in BT SDP dissector which could lead to a memory leak. (bsc#1214562)
- CVE-2023-2906: Fixed a bug in CP2179 dissector which could lead to crash. (bsc#1214652)
- Record
SUSE-SU-2023:3778-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 4.0.11-1~deb12u1, plus listed versions 4.0.10-14.0.3-14.0.5-1~exp14.0.6-14.0.6-1~deb12u14.0.6-1~exp14.0.7-14.0.8-1 |
4.0.11-1~deb12u1 |
wiresharkDebian:13 |
before 4.0.8-1 | 4.0.8-1 |
wiresharkDebian:14 |
before 4.0.8-1 | 4.0.8-1 |
wiresharkDebian:10 From an advisory covering 4 CVEs |
before 2.6.20-0+deb10u8, plus listed versions 2.6.10-12.6.20-0+deb10u12.6.20-0+deb10u22.6.20-0+deb10u32.6.20-0+deb10u4 Show 5 moreShow less2.6.20-0+deb10u52.6.20-0+deb10u62.6.20-0+deb10u72.6.8-1.12.6.9-1 |
2.6.20-0+deb10u8 |
wiresharkDebian:11 From an advisory covering 47 CVEs |
before 3.4.16-0+deb11u1, plus listed versions 3.4.10-0+deb11u13.4.4-13.4.6-1~exp13.4.7-13.4.7-1~exp13.4.8-13.4.9-1 |
3.4.16-0+deb11u1 |
wiresharkDebian:12 From an advisory covering 9 CVEs |
before 4.0.11-1~deb12u1, plus listed versions 4.0.10-14.0.3-14.0.5-1~exp14.0.6-14.0.6-1~deb12u14.0.6-1~exp14.0.7-14.0.8-1 |
4.0.11-1~deb12u1 |
wiresharkMageia:9 From an advisory covering 4 CVEs |
before 4.0.8-1.mga9 | 4.0.8-1.mga9 |
wiresharkopenEuler:20.03-LTS-SP1 From an advisory covering 4 CVEs |
before 3.6.14-3.oe1 | 3.6.14-3.oe1 |
wiresharkopenEuler:20.03-LTS-SP3 From an advisory covering 4 CVEs |
before 3.6.14-3.oe1 | 3.6.14-3.oe1 |
wiresharkopenEuler:22.03-LTS From an advisory covering 4 CVEs |
before 3.6.14-3.oe2203sp2 | 3.6.14-3.oe2203sp2 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkopenEuler:22.03-LTS-SP1 From an advisory covering 4 CVEs |
before 3.6.14-3.oe2203sp1 | 3.6.14-3.oe2203sp1 |
wiresharkopenEuler:22.03-LTS-SP2 From an advisory covering 4 CVEs |
before 3.6.14-3.oe2203sp2 | 3.6.14-3.oe2203sp2 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkSUSE:Manager Proxy 4.2 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkSUSE:Manager Server 4.2 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkopenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkopenSUSE:Leap 15.5 From an advisory covering 4 CVEs |
before 3.6.16-150000.3.100.1 | 3.6.16-150000.3.100.1 |
wiresharkUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 9 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.02.6.8-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm22.6.10-1~ubuntu14.04.0~esm3 |
None known |
wiresharkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 8 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.02.6.8-1~ubuntu16.04.02.6.10-1~ubuntu16.04.02.6.10-1~ubuntu16.04.0+esm12.6.10-1~ubuntu16.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 Show 7 moreShow less2.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.02.6.8-1~ubuntu18.04.02.6.10-1~ubuntu18.04.02.6.10-1~ubuntu18.04.0+esm12.6.10-1~ubuntu18.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.5-13.0.7-13.2.1-13.2.2-13.2.3-13.2.3-1ubuntu0.1~esm13.2.3-1ubuntu0.1~esm2 |
None known |
wiresharkUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.4.7-1~exp13.4.9-13.6.2-1ubuntu13.6.2-23.6.2-2ubuntu0.1~esm1 |
None known |
wiresharkopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 4.0.8-2.1 | 4.0.8-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4513 is a medium vulnerability (CVSS 5.3) in Wireshark, published August 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 44th percentile. Fixed in wireshark 4.0.11-1~deb12u1.
References
wireshark.org/security/wnpa-sec-2023-25.html
gitlab.com/wireshark/wireshark/-/issues/19259
lists.fedoraproject.org/archives/list/[email protected]/message/L4AVRUYSHDNEAJILVSGY5W6MPOMG2YRF
lists.debian.org/debian-lts-announce/2024/02/msg00016.html
Show 25 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-4513
github.com/advisories/GHSA-m8r8-3226-6wp8
security-tracker.debian.org/tracker/CVE-2023-4513
advisories.mageia.org/MGASA-2023-0275.html
bugs.mageia.org/show_bug.cgi?id=32275
cve.org/CVERecord?id=CVE-2023-2906
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1652
suse.com/support/update/announcement/2023/suse-su-20233778-1
bugzilla.suse.com/1214560
ubuntu.com/security/CVE-2023-4513