CVE-2011-0538
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer...
6.8 MediumPublic exploitFix available
CVE-2011-0538 is a medium vulnerability (CVSS 6.8) in Wireshark, published February 8, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.51%, the 94th percentile. Fixed in wireshark 1.4.3-3.
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
Exploit likelihood
7.51%Down 5.1 points since Feb 4, 2022
What each source reports
NVD Score used
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
- Record
CVE-2011-0538- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
- Record
CVE-2011-0538- Updated
- 2026-11-02
EUVDEUVD-2011-0556 No score
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
- Record
EUVD-2011-0556- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mh8c-wx62-vg9v No score
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer...
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
- Record
GHSA-mh8c-wx62-vg9v- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
- Record
CVE-2011-0538- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-0538 No score
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
- Record
DEBIAN-CVE-2011-0538- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10199-1 No score
wireshark-2.2.2-1.1 on GA media
These are all security issues fixed in the wireshark-2.2.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10199-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 1.4.3-3 | 1.4.3-3 |
wiresharkDebian:13 |
before 1.4.3-3 | 1.4.3-3 |
wiresharkDebian:14 |
before 1.4.3-3 | 1.4.3-3 |
wiresharkDebian:5.0 |
before 1.0.2-3+lenny13, plus listed versions 1.0.2-3+lenny101.0.2-3+lenny111.0.2-3+lenny121.0.2-3+lenny31.0.2-3+lenny4 Show 5 moreShow less1.0.2-3+lenny51.0.2-3+lenny61.0.2-3+lenny71.0.2-3+lenny81.0.2-3+lenny9 |
1.0.2-3+lenny13 |
wiresharkDebian:6.0 |
before 1.2.11-6+squeeze1, plus listed versions 1.2.11-6 |
1.2.11-6+squeeze1 |
wiresharkRed Hat:enterprise_linux:6::client |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-develRed Hat:enterprise_linux:6::client |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-gnomeRed Hat:enterprise_linux:6::client |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wiresharkRed Hat:enterprise_linux:6::server |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wireshark-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-develRed Hat:enterprise_linux:6::server |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-gnomeRed Hat:enterprise_linux:6::server |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wiresharkRed Hat:enterprise_linux:6::workstation |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-develRed Hat:enterprise_linux:6::workstation |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wireshark-gnomeRed Hat:enterprise_linux:6::workstation |
before 0:1.2.15-1.el6_0.1 | 0:1.2.15-1.el6_0.1 |
wiresharkRed Hat:enterprise_linux:4::as |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-gnomeRed Hat:enterprise_linux:4::as |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wiresharkRed Hat:enterprise_linux:4::desktop |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-gnomeRed Hat:enterprise_linux:4::desktop |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wiresharkRed Hat:enterprise_linux:4::es |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-gnomeRed Hat:enterprise_linux:4::es |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wiresharkRed Hat:enterprise_linux:4::ws |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wireshark-gnomeRed Hat:enterprise_linux:4::ws |
before 0:1.0.15-2.el4 | 0:1.0.15-2.el4 |
wiresharkRed Hat:enterprise_linux:5::server |
before 0:1.0.15-1.el5_6.4 | 0:1.0.15-1.el5_6.4 |
wireshark-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.0.15-1.el5_6.4 | 0:1.0.15-1.el5_6.4 |
wireshark-gnomeRed Hat:enterprise_linux:5::server |
before 0:1.0.15-1.el5_6.4 | 0:1.0.15-1.el5_6.4 |
wiresharkopenSUSE:Tumbleweed |
before 2.2.2-1.1 | 2.2.2-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Wireshark 1.4.3 - '.pcap' Memory Corruption | 2011-02-03 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/43759
lists.fedoraproject.org/pipermail/package-announce/2011-March/055364.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14605
wireshark.org/docs/relnotes/wireshark-1.2.15.html
vupen.com/english/advisories/2011/0747
Show 194 moreShow less
kb.cert.org/vuls/id/215900
openwall.com/lists/oss-security/2011/02/04/1
redhat.com/support/errata/RHSA-2011-0370.html
bugs.wireshark.org/bugzilla/show_bug.cgi?id=5652
exchange.xforce.ibmcloud.com/vulnerabilities/65182
mandriva.com/security/advisories?name=MDVSA-2011:044
securitytracker.com/id?1025148
bugzilla.redhat.com/show_bug.cgi?id=676232
securityfocus.com/bid/46167
debian.org/security/2011/dsa-2201
nvd.nist.gov/vuln/detail/CVE-2011-0538
github.com/advisories/GHSA-mh8c-wx62-vg9v
security-tracker.debian.org/tracker/CVE-2011-0538
access.redhat.com/errata/RHSA-2011:0369
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0369.json
cve.org/CVERecord?id=CVE-2011-0444
suse.com/security/cve/CVE-2009-1210
This page doesn't list everything
Left out here: 131 references. The JSON record has them.