CVE-2015-8726

MEDIUM

Wireshark - Memory Corruption

Title source: rule

Description

wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · textdosmultiple

https://www.exploit-db.com/exploits/39004

View Code ZIP pw:eip

References (10)

[Vendor Advisory] http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1034551

[Vendor Advisory] http://www.wireshark.org/security/wnpa-sec-2015-44.html

[Issue Tracking] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11789

[Issue Tracking] https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11791

[Patch] https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=185911de7d337246044c8e99da2f5b4bac74c0d5

[Patch] https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b8fa3d463c1bdd9b84c897441e7a5c8ad1f0f292

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/79382

[Third Party Advisory] http://www.debian.org/security/2016/dsa-3505

[Third Party Advisory] https://security.gentoo.org/glsa/201604-05

Scores

CVSS v3 5.5

EPSS 0.0097

EPSS Percentile 76.4%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

CWE

CWE-119 CWE-20

Status draft

Affected Products (10)

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

wireshark/wireshark

Timeline

Published Jan 04, 2016

Tracked Since Feb 18, 2026