5.9

CVE-2016-9373

In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wireshark ≫ Wireshark Version2.0.0
Wireshark ≫ Wireshark Version2.0.1
Wireshark ≫ Wireshark Version2.0.2
Wireshark ≫ Wireshark Version2.0.3
Wireshark ≫ Wireshark Version2.0.4
Wireshark ≫ Wireshark Version2.0.5
Wireshark ≫ Wireshark Version2.0.6
Wireshark ≫ Wireshark Version2.0.7
Wireshark ≫ Wireshark Version2.2.0
Wireshark ≫ Wireshark Version2.2.1
Debian ≫ Debian Linux Version8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.72% 0.746
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.securitytracker.com/id/1037313
http://www.debian.org/security/2016/dsa-3719
Third Party Advisory
http://www.securityfocus.com/bid/94369
Third Party Advisory
VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13072
Issue Tracking
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=cc8e37f0f53c4401bb1644a34eddea345940a8df
https://www.wireshark.org/security/wnpa-sec-2016-61.html
Vendor Advisory