CVE-2017-7702

libwireshark11: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by pac...

CVE-2017-7702 is fixed in 10 products on 1 platform, first by libwireshark-data 2.6.3-1~ubuntu18.04.1, released August 29, 2018. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0271
86th percentile

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation.

Where it's fixed

ProductFixed inFixReleased
Linux
libwireshark-data · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwireshark-data 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwireshark11 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwireshark11 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwiretap8 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwiretap8 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwscodecs2 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwscodecs2 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwsutil9 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwsutil9 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
tshark · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 tshark 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark-common · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark-common 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark-gtk · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark-gtk 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark-qt · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark-qt 2.6.3-1~ubuntu18.04.1 Aug 29, 2018