CVE-2017-15191
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash....
7.5 HighFix available
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
2.72%Up 1.3 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
CVE-2017-15191- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
CVE-2017-15191- Updated
- 2026-11-02
EUVDEUVD-2017-6651 No score
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
EUVD-2017-6651- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rmxr-5w24-74wc
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash....
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
GHSA-rmxr-5w24-74wc- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-134
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-15191
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
ALPINE-CVE-2017-15191- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
CVE-2017-15191- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2017-15191
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
DEBIAN-CVE-2017-15191- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-15191
In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.
- Record
UBUNTU-CVE-2017-15191- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0374 No score
Updated wireshark packages fix security vulnerability
DMP dissector crash (CVE-2017-15191).
BT ATT dissector crash (CVE-2017-15192).
MBIM dissector crash (CVE-2017-15193).
- Record
MGASA-2017-0374- Updated
- 2026-11-02
OSVMGASA-2017-0375 No score
Updated wireshark packages fix security vulnerability
DMP dissector crash (CVE-2017-15191).
- Record
MGASA-2017-0375- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2860-1 No score
Security update for wireshark
This update for wireshark fixes the following issues:
Wireshark was updated to 2.2.10, fixing security issues and bugs:
- CVE-2017-15191: DMP dissector crash (wnpa-sec-2017-44)
- CVE-2017-15192: BT ATT dissector crash (wnpa-sec-2017-42)
- CVE-2017-15193: MBIM dissector crash (wnpa-sec-2017-43)
- Record
SUSE-SU-2017:2860-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0054-1 No score
Security update for wireshark
This update for wireshark to version 2.2.11 fixes several issues.
These security issues were fixed:
- CVE-2017-13767: The MSDP dissector could have gone into an infinite loop. This was addressed by adding length validation (bsc#1056248)
- CVE-2017-13766: The Profinet I/O dissector could have crash with an out-of-bounds write. This was addressed by adding string validation (bsc#1056249)
- CVE-2017-13765: The IrCOMM dissector had a buffer over-read and application crash. This was addressed by adding length validation (bsc#1056251)
- CVE-2017-9766: PROFINET IO data with a high recursion depth allowed remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function (bsc#1045341)
- CVE-2017-9617: Deeply nested DAAP data may have cause stack exhaustion (uncontrolled recursion) in the dissect_daap_one_tag function in the DAAP dissector (bsc#1044417)
- CVE-2017-15192: The BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level. (bsc#1062645)
- CVE-2017-15193: The MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach. (bsc#1062645)
- CVE-2017-15191: The DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length. (bsc#1062645)
- CVE-2017-17083: NetBIOS dissector could crash. This was addressed in epan/dissectors/packet-netbios.c by ensuring that write operations are bounded by the beginning of a buffer. (bsc#1070727)
- CVE-2017-17084: IWARP_MPA dissector could crash. This was addressed in epan/dissectors/packet-iwarp-mpa.c by validating a ULPDU length. (bsc#1070727)
- CVE-2017-17085: the CIP Safety dissector could crash. This was addressed in epan/dissectors/packet-cipsafety.c by validating the packet length. (bsc#1070727)
- Record
SUSE-SU-2018:0054-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.5 |
2.0.0 up to 2.2.10-r0 | 2.2.10-r0 |
wiresharkDebian:12 |
before 2.4.2-1 | 2.4.2-1 |
wiresharkDebian:13 |
before 2.4.2-1 | 2.4.2-1 |
wiresharkDebian:14 |
before 2.4.2-1 | 2.4.2-1 |
wiresharkDebian:8 From an advisory covering 41 CVEs |
before 1.12.1+g01b65bf-4+deb8u16, plus listed versions 1.12.1+g01b65bf-41.12.1+g01b65bf-4+deb8u11.12.1+g01b65bf-4+deb8u101.12.1+g01b65bf-4+deb8u111.12.1+g01b65bf-4+deb8u12 Show 22 moreShow less1.12.1+g01b65bf-4+deb8u131.12.1+g01b65bf-4+deb8u141.12.1+g01b65bf-4+deb8u151.12.1+g01b65bf-4+deb8u21.12.1+g01b65bf-4+deb8u31.12.1+g01b65bf-4+deb8u41.12.1+g01b65bf-4+deb8u51.12.1+g01b65bf-4+deb8u61.12.1+g01b65bf-4+deb8u6~deb7u11.12.1+g01b65bf-4+deb8u6~deb7u101.12.1+g01b65bf-4+deb8u6~deb7u111.12.1+g01b65bf-4+deb8u6~deb7u21.12.1+g01b65bf-4+deb8u6~deb7u31.12.1+g01b65bf-4+deb8u6~deb7u41.12.1+g01b65bf-4+deb8u6~deb7u51.12.1+g01b65bf-4+deb8u6~deb7u61.12.1+g01b65bf-4+deb8u6~deb7u71.12.1+g01b65bf-4+deb8u6~deb7u81.12.1+g01b65bf-4+deb8u6~deb7u91.12.1+g01b65bf-4+deb8u71.12.1+g01b65bf-4+deb8u81.12.1+g01b65bf-4+deb8u9 |
1.12.1+g01b65bf-4+deb8u16 |
wiresharkMageia:6 From an advisory covering 3 CVEs |
before 2.2.10-1.mga6 | 2.2.10-1.mga6 |
wiresharkMageia:5 |
before 2.0.16-1.mga5 | 2.0.16-1.mga5 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
wiresharkSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 3 CVEs |
before 2.2.10-48.12.1 | 2.2.10-48.12.1 |
libsmiSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 11 CVEs |
before 0.4.5-2.7.2.1 | 0.4.5-2.7.2.1 |
portaudioSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 11 CVEs |
before 19-234.18.1 | 19-234.18.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 11 CVEs |
before 2.2.11-40.14.5 | 2.2.11-40.14.5 |
libsmiSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 11 CVEs |
before 0.4.5-2.7.2.1 | 0.4.5-2.7.2.1 |
portaudioSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 11 CVEs |
before 19-234.18.1 | 19-234.18.1 |
wiresharkSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 11 CVEs |
before 2.2.11-40.14.5 | 2.2.11-40.14.5 |
libsmiSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 11 CVEs |
before 0.4.5-2.7.2.1 | 0.4.5-2.7.2.1 |
portaudioSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 11 CVEs |
before 19-234.18.1 | 19-234.18.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 11 CVEs |
before 2.2.11-40.14.5 | 2.2.11-40.14.5 |
wiresharkUbuntu:14.04:LTS |
before 2.6.3-1~ubuntu14.04.1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-11.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 |
2.6.3-1~ubuntu14.04.1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.3-1~ubuntu16.04.1, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 |
2.6.3-1~ubuntu16.04.1 |
wiresharkUbuntu:18.04:LTS |
before 2.6.3-1~ubuntu18.04.1, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-1 |
2.6.3-1~ubuntu18.04.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15191 is a high vulnerability (CVSS 7.5) in Wireshark, published October 10, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.72%, the 86th percentile. Fixed in wireshark 2.2.10-r0.
References
wireshark.org/security/wnpa-sec-2017-44.html
bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068
lists.debian.org/debian-lts-announce/2019/01/msg00010.html
securityfocus.com/bid/101227
code.wireshark.org/review/23591
Show 191 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-15191
github.com/advisories/GHSA-rmxr-5w24-74wc
security.alpinelinux.org/vuln/CVE-2017-15191
security-tracker.debian.org/tracker/CVE-2017-15191
advisories.mageia.org/MGASA-2017-0374.html
bugs.mageia.org/show_bug.cgi?id=21839
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15191
suse.com/support/update/announcement/2017/suse-su-20172860-1
bugzilla.suse.com/1062645
ubuntu.com/security/CVE-2017-15191
cve.org/CVERecord?id=CVE-2017-15191