CVE-2017-7748

libwireshark11: In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packe...

CVE-2017-7748 is fixed in 10 products on 1 platform, first by libwireshark-data 2.6.3-1~ubuntu18.04.1, released August 29, 2018. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0277
86th percentile

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check.

Where it's fixed

ProductFixed inFixReleased
Linux
libwireshark-data · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwireshark-data 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwireshark11 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwireshark11 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwiretap8 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwiretap8 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwscodecs2 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwscodecs2 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
libwsutil9 · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 libwsutil9 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
tshark · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 tshark 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark-common · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark-common 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark-gtk · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark-gtk 2.6.3-1~ubuntu18.04.1 Aug 29, 2018
wireshark-qt · Ubuntu 18.04.6 LTS (bionic) 2.6.3-1~ubuntu18.04.1 wireshark-qt 2.6.3-1~ubuntu18.04.1 Aug 29, 2018