CVE-2014-5162

The read_new_line function in wiretap/catapult_dct2000.c in the Catapult DCT2000 dissector in...

5.0 MediumFix available

CVE-2014-5162 is a medium vulnerability (CVSS 5.0) in Wireshark, published August 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.47%, the 84th percentile. Fixed in wireshark 1.12.0+git+4fab41a1-1.

What does this mean?

Severity: 5.0 MediumCVSS 2.0, NVD
Exploit chance: 2.47%EPSS, 84th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.12.0+git+4fab41a1-1wireshark +7 more

Description

The read_new_line function in wiretap/catapult_dct2000.c in the Catapult DCT2000 dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' and '\r' characters, which allows remote attackers to cause a denial of service (off-by-one buffer underflow and application crash) via a crafted packet.

Exploit likelihood

2.47%Up 1.1 points since Feb 4, 2022

Affected products

wireshark

Affected packages

Affected packages
Package	Affected	Fixed
`wireshark` Debian:12	before 1.12.0+git+4fab41a1-1	1.12.0+git+4fab41a1-1
`wireshark` Debian:13	before 1.12.0+git+4fab41a1-1	1.12.0+git+4fab41a1-1
`wireshark` Debian:14	before 1.12.0+git+4fab41a1-1	1.12.0+git+4fab41a1-1
`wireshark` Debian:6.0 From an advisory covering 3 CVEs	before 1.2.11-6+squeeze15, plus listed versions 1.2.11-61.2.11-6+squeeze11.2.11-6+squeeze101.2.11-6+squeeze111.2.11-6+squeeze12 Show 9 moreShow less 1.2.11-6+squeeze131.2.11-6+squeeze141.2.11-6+squeeze21.2.11-6+squeeze41.2.11-6+squeeze51.2.11-6+squeeze61.2.11-6+squeeze71.2.11-6+squeeze81.2.11-6+squeeze9	1.2.11-6+squeeze15
`wireshark` Debian:7 From an advisory covering 5 CVEs	before 1.8.2-5wheezy11, plus listed versions 1.8.2-5wheezy101.8.2-5wheezy21.8.2-5wheezy31.8.2-5wheezy41.8.2-5wheezy5 Show 4 moreShow less 1.8.2-5wheezy61.8.2-5wheezy71.8.2-5wheezy81.8.2-5wheezy9	1.8.2-5wheezy11
`wireshark` Mageia:3 From an advisory covering 5 CVEs	before 1.10.9-1.mga3	1.10.9-1.mga3
`wireshark` Mageia:4 From an advisory covering 5 CVEs	before 1.10.9-1.mga4	1.10.9-1.mga4
`wireshark` openSUSE:Tumbleweed From an advisory covering 262 CVEs	before 2.2.2-1.1	2.2.2-1.1