CVE-2023-2906

MEDIUM

Wireshark < 4.0.7 - Divide By Zero

Title source: rule

Description

Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack.

References (6)

[Exploit, Issue Tracking, Patch, Third Party Advisory] https://gitlab.com/wireshark/wireshark/-/issues/19229

[Exploit, Third Party Advisory] https://takeonme.org/cves/CVE-2023-2906.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/6HCUPLDY7HLPO46PHMGIJSUBJFTT237C/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/L4AVRUYSHDNEAJILVSGY5W6MPOMG2YRF/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/TRKHFQPWFU7F3OXTL6IEIQSJG6FVXZTZ/

Scores

CVSS v3 6.5

EPSS 0.0013

EPSS Percentile 32.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

CWE

CWE-369

Status published

Affected Products (1)

wireshark/wireshark < 4.0.7

Timeline

Published Aug 25, 2023

Tracked Since Feb 18, 2026