CVE-2017-11408
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was...
7.5 HighFix available
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
2.35%Up 0.5 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
CVE-2017-11408- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
CVE-2017-11408- Updated
- 2026-11-02
EUVDEUVD-2017-3035 No score
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
EUVD-2017-3035- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mp2f-25wx-mmj7
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was...
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
GHSA-mp2f-25wx-mmj7- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-11408
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
ALPINE-CVE-2017-11408- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
CVE-2017-11408- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2017-11408
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
DEBIAN-CVE-2017-11408- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-11408
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful list dissection.
- Record
UBUNTU-CVE-2017-11408- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0219 No score
Updated wireshark packages fix security vulnerabilities
The wireshark package has been updated to version 2.0.14, which fixes several security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details.
- Record
MGASA-2017-0219- Updated
- 2026-11-02
OSVMGASA-2017-0226 No score
Updated wireshark packages fix security vulnerabilities
The wireshark package has been updated to version 2.2.8, which fixes several security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details.
- Record
MGASA-2017-0226- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2032-1 No score
Security update for wireshark
This wireshark update to version 2.2.8 fixes the following issues:
Security issues fixed:
- CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. (bsc#1049621)
- CVE-2017-11410: The WBXML dissector could go into an infinite loop. (bsc#1049255)
- CVE-2017-11408: The AMQP dissector could crash. (bsc#1049255)
- CVE-2017-11407: The MQ dissector could crash. (bsc#1049255)
- CVE-2017-11406: The DOCSIS dissector could go into an infinite loop. (bsc#1049255)
- Record
SUSE-SU-2017:2032-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2033-1 No score
Security update for wireshark
This wireshark update to version 2.2.8 fixes the following issues:
Security issues fixed:
- CVE-2017-11411: The openSAFETY dissectorcould crash or exhaust system memory because of missing length validation. (bsc#1049621)
- CVE-2017-11410: The WBXML dissector could go into an infinite loop. (bsc#1049255)
- CVE-2017-11408: The AMQP dissector could crash. (bsc#1049255)
- CVE-2017-11407: The MQ dissector could crash. (bsc#1049255)
- CVE-2017-11406: The DOCSIS dissector could go into an infinite loop. (bsc#1049255)
- Record
SUSE-SU-2017:2033-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.5 |
before 2.2.8-r0 | 2.2.8-r0 |
wiresharkDebian:12 |
before 2.4.0-1 | 2.4.0-1 |
wiresharkDebian:13 |
before 2.4.0-1 | 2.4.0-1 |
wiresharkDebian:14 |
before 2.4.0-1 | 2.4.0-1 |
wiresharkDebian:7 From an advisory covering 4 CVEs |
before 1.12.1+g01b65bf-4+deb8u6~deb7u8, plus listed versions 1.10.0-11.10.0-21.10.0-2~bpo70+11.10.0~rc1-11.10.0~rc2-1 Show 45 moreShow less1.10.1-11.10.1-1~bpo70+11.10.2-11.10.2-1~bpo70+11.10.2-21.10.3-11.10.3-1~bpo70+11.10.4-11.10.5-11.10.5-1~bpo70+11.10.5-21.10.6-11.10.6-1~bpo70+11.10.7-11.10.7-1~bpo70+11.10.7-21.10.7-31.10.7-41.10.8-11.10.8-1~bpo70+11.12.0+git+4fab41a1-11.12.0~rc1-11.12.0~rc1-21.12.0~rc2+git+fd017ee+dfsg1-11.12.0~rc3+git+e14d5b6eaa+dfsg1-11.12.1+g01b65bf-11.12.1+g01b65bf-1~bpo70+11.12.1+g01b65bf-21.12.1+g01b65bf-2~bpo70+11.12.1+g01b65bf-31.12.1+g01b65bf-41.12.1+g01b65bf-4~bpo70+11.8.2-5wheezy101.8.2-5wheezy111.8.2-5wheezy121.8.2-5wheezy131.8.2-5wheezy141.8.2-5wheezy151.8.2-5wheezy15~deb6u11.8.2-5wheezy161.8.2-5wheezy16~deb6u11.8.2-5wheezy171.8.2-5wheezy181.8.2-5wheezy21.8.2-5wheezy3 |
1.12.1+g01b65bf-4+deb8u6~deb7u8 |
wiresharkDebian:8 From an advisory covering 4 CVEs |
before 1.12.1+g01b65bf-4+deb8u12, plus listed versions 1.12.1+g01b65bf-41.12.1+g01b65bf-4+deb8u11.12.1+g01b65bf-4+deb8u101.12.1+g01b65bf-4+deb8u111.12.1+g01b65bf-4+deb8u2 Show 18 moreShow less1.12.1+g01b65bf-4+deb8u31.12.1+g01b65bf-4+deb8u41.12.1+g01b65bf-4+deb8u51.12.1+g01b65bf-4+deb8u61.12.1+g01b65bf-4+deb8u6~deb7u11.12.1+g01b65bf-4+deb8u6~deb7u101.12.1+g01b65bf-4+deb8u6~deb7u111.12.1+g01b65bf-4+deb8u6~deb7u21.12.1+g01b65bf-4+deb8u6~deb7u31.12.1+g01b65bf-4+deb8u6~deb7u41.12.1+g01b65bf-4+deb8u6~deb7u51.12.1+g01b65bf-4+deb8u6~deb7u61.12.1+g01b65bf-4+deb8u6~deb7u71.12.1+g01b65bf-4+deb8u6~deb7u81.12.1+g01b65bf-4+deb8u6~deb7u91.12.1+g01b65bf-4+deb8u71.12.1+g01b65bf-4+deb8u81.12.1+g01b65bf-4+deb8u9 |
1.12.1+g01b65bf-4+deb8u12 |
wiresharkDebian:9 From an advisory covering 4 CVEs |
before 2.2.6+g32dac6a-2+deb9u1, plus listed versions 2.2.6+g32dac6a-2 |
2.2.6+g32dac6a-2+deb9u1 |
wiresharkMageia:5 From an advisory covering 6 CVEs |
before 2.0.14-1.mga5 | 2.0.14-1.mga5 |
wiresharkMageia:6 From an advisory covering 5 CVEs |
before 2.2.8-1.mga6 | 2.2.8-1.mga6 |
wiresharkSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 5 CVEs |
before 2.0.14-40.7.1 | 2.0.14-40.7.1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 5 CVEs |
before 2.0.14-40.7.1 | 2.0.14-40.7.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 5 CVEs |
before 2.0.14-40.7.1 | 2.0.14-40.7.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 5 CVEs |
before 2.2.8-48.6.1 | 2.2.8-48.6.1 |
wiresharkUbuntu:14.04:LTS |
before 2.6.3-1~ubuntu14.04.1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-11.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 |
2.6.3-1~ubuntu14.04.1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.3-1~ubuntu16.04.1, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 |
2.6.3-1~ubuntu16.04.1 |
wiresharkUbuntu:18.04:LTS |
before 2.6.3-1~ubuntu18.04.1, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-1 |
2.6.3-1~ubuntu18.04.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-11408 is a high vulnerability (CVSS 7.5) in Wireshark, published July 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in wireshark 2.2.8-r0.
References
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a102c172b0b2fe231fdb49f4f6694603f5b93b0c
debian.org/security/2017/dsa-4060
bugs.wireshark.org/bugzilla/show_bug.cgi?id=13780
lists.debian.org/debian-lts-announce/2017/12/msg00029.html
securitytracker.com/id/1038966
Show 191 moreShow less
securityfocus.com/bid/99894
wireshark.org/security/wnpa-sec-2017-34.html
nvd.nist.gov/vuln/detail/CVE-2017-11408
github.com/advisories/GHSA-mp2f-25wx-mmj7
security.alpinelinux.org/vuln/CVE-2017-11408
security-tracker.debian.org/tracker/CVE-2017-11408
advisories.mageia.org/MGASA-2017-0219.html
bugs.mageia.org/show_bug.cgi?id=21315
suse.com/support/update/announcement/2017/suse-su-20172032-1
bugzilla.suse.com/1049255
ubuntu.com/security/CVE-2017-11408
cve.org/CVERecord?id=CVE-2017-11408
This page doesn't list everything
Left out here: 13 versions. The JSON record has them.