CVE-2020-26575

HIGH

Wireshark <3.2.7 - DoS

Title source: llm
STIX 2.1

Description

In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero.c by correcting the implementation of offset advancement.

References (12)

Core 12
Core References
Patch, Third Party Advisory x_refsource_misc
https://gitlab.com/wireshark/wireshark/-/merge_requests/467
Patch, Third Party Advisory x_refsource_misc
https://gitlab.com/wireshark/wireshark/-/merge_requests/471
Patch, Third Party Advisory x_refsource_misc
https://gitlab.com/wireshark/wireshark/-/merge_requests/472
Patch, Third Party Advisory x_refsource_misc
https://gitlab.com/wireshark/wireshark/-/merge_requests/473
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202011-08
Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2021.html
Vendor Advisory x_refsource_confirm
https://www.wireshark.org/security/wnpa-sec-2020-14.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html

Scores

CVSS v3 7.5
EPSS 0.0223
EPSS Percentile 84.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-835
Status published
Products (5)
debian/debian_linux 9.0
fedoraproject/fedora 32
fedoraproject/fedora 33
oracle/zfs_storage_appliance_firmware 8.8
wireshark/wireshark < 3.2.7
Published Oct 06, 2020
Tracked Since Feb 18, 2026