CVE-2020-9428
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash....
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
CVE-2020-9428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
CVE-2020-9428- Updated
- 2026-11-02
EUVDEUVD-2020-30248 No score
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
EUVD-2020-30248- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q44r-xw3x-72c6 No score
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash....
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
GHSA-q44r-xw3x-72c6- Weakness
- CWE-74
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-9428
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
ALPINE-CVE-2020-9428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
CVE-2020-9428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2020-9428
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
DEBIAN-CVE-2020-9428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2021-1132
wireshark security update
Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer. Wireshark, formerly known as Ethereal, can be used to examine the details of traffic at a variety of levels ranging from connection-level information to the bits that make up a single packet. Packet capture can provide a network administrator with information about individual packets such as transmit time, source, destination, protocol type and header data. This information can be useful for evaluating security events and troubleshooting network security device issues.
Security Fix(es):
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.(CVE-2020-9431)
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.(CVE-2020-9428)
In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection.(CVE-2019-19553)
In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c by properly restricting buffer increments.(CVE-2019-13619)
- Record
OESA-2021-1132- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-9428
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
- Record
UBUNTU-CVE-2020-9428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0362-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0362-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0693-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
- Record
SUSE-SU-2020:0693-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.10 |
2.6.0 up to 3.0.9-r0 | 3.0.9-r0 |
wiresharkAlpine:v3.11 |
2.6.0 up to 3.0.9-r0 | 3.0.9-r0 |
wiresharkAlpine:v3.12 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.13 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.14 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.15 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.16 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.17 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.18 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.19 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.20 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.21 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.22 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.23 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.24 |
2.6.0 up to 3.2.2-r0 | 3.2.2-r0 |
wiresharkAlpine:v3.9 |
2.6.0 up to 2.6.15-r0 | 2.6.15-r0 |
wiresharkDebian:12 |
before 3.2.2-1 | 3.2.2-1 |
wiresharkDebian:13 |
before 3.2.2-1 | 3.2.2-1 |
wiresharkDebian:14 |
before 3.2.2-1 | 3.2.2-1 |
wiresharkDebian:9 From an advisory covering 17 CVEs |
before 2.6.20-0+deb9u1, plus listed versions 2.2.6+g32dac6a-22.2.6+g32dac6a-2+deb9u12.2.6+g32dac6a-2+deb9u22.2.6+g32dac6a-2+deb9u32.2.7-1 Show 24 moreShow less2.4.0-12.4.1-12.4.2-12.4.3-12.4.4-12.4.5-12.4.6-12.6.1-12.6.10-12.6.2-12.6.2-22.6.3-12.6.3-1~deb9u12.6.4-12.6.4-22.6.5-12.6.5-1~deb9u12.6.6-12.6.7-12.6.7-1~deb9u12.6.8-12.6.8-1.12.6.8-1.1~deb9u12.6.9-1 |
2.6.20-0+deb9u1 |
wiresharkopenEuler:20.03-LTS From an advisory covering 4 CVEs |
before 2.6.2-19.oe1 | 2.6.2-19.oe1 |
wiresharkopenEuler:20.03-LTS-SP1 From an advisory covering 4 CVEs |
before 2.6.2-19.oe1 | 2.6.2-19.oe1 |
libmaxminddbSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
spandspSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
wiresharkUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 9 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.02.6.8-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm22.6.10-1~ubuntu14.04.0~esm3 |
None known |
wiresharkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 8 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.02.6.8-1~ubuntu16.04.02.6.10-1~ubuntu16.04.02.6.10-1~ubuntu16.04.0+esm12.6.10-1~ubuntu16.04.0+esm2 |
None known |
wiresharkUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 Show 7 moreShow less2.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.02.6.8-1~ubuntu18.04.02.6.10-1~ubuntu18.04.02.6.10-1~ubuntu18.04.0+esm12.6.10-1~ubuntu18.04.0+esm2 |
None known |
libmaxminddbopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 1.4.2-lp151.3.3.1 | 1.4.2-lp151.3.3.1 |
spandspopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 0.0.6-lp151.3.3.1 | 0.0.6-lp151.3.3.1 |
wiresharkopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 3.2.2-lp151.2.9.1 | 3.2.2-lp151.2.9.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-9428 is a high vulnerability (CVSS 7.5) in Wireshark, published February 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.11%, the 87th percentile. Fixed in wireshark 3.0.9-r0.
References
bugs.wireshark.org/bugzilla/show_bug.cgi?id=16397
wireshark.org/security/wnpa-sec-2020-05.html
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=9fe2de783dbcbe74144678d60a4e3923367044b2
lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZBICEY2HGSNQ3RPBLMDDYVAHGOGS4E2
Show 194 moreShow less
security.gentoo.org/glsa/202007-13
lists.debian.org/debian-lts-announce/2021/02/msg00008.html
nvd.nist.gov/vuln/detail/CVE-2020-9428
github.com/advisories/GHSA-q44r-xw3x-72c6
security.alpinelinux.org/vuln/CVE-2020-9428
security-tracker.debian.org/tracker/CVE-2020-9428
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1132
suse.com/support/update/announcement/2020/suse-su-20200693-1
bugzilla.suse.com/1093733
ubuntu.com/security/CVE-2020-9428
cve.org/CVERecord?id=CVE-2020-9428
Left out here: 22 references. The JSON record has them.