Description
The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
References (7)
Core 7
Core References
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11110
Patch x_refsource_confirm
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e243b0041328980a9bbd43bb8a8166d7422f9096
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2015/dsa-3277
Vendor Advisory x_refsource_confirm
http://www.wireshark.org/security/wnpa-sec-2015-17.html
Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201510-03
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74631
Scores
EPSS
0.0017
EPSS Percentile
37.5%
Details
CWE
CWE-189
Status
published
Products (21)
oracle/solaris
11.2
wireshark/wireshark
1.10.0
wireshark/wireshark
1.10.1
wireshark/wireshark
1.10.2
wireshark/wireshark
1.10.3
wireshark/wireshark
1.10.4
wireshark/wireshark
1.10.5
wireshark/wireshark
1.10.6
wireshark/wireshark
1.10.7
wireshark/wireshark
1.10.8
... and 11 more
Published
May 26, 2015
Tracked Since
Feb 18, 2026