CVE-2015-6244

Publication date 24 August 2015

Last updated 24 July 2024

Ubuntu priority

The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
wireshark	18.04 LTS bionic	Fixed 2.6.3-1~ubuntu18.04.1
	17.10 artful	Not affected
	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Fixed 2.6.3-1~ubuntu16.04.1
	15.10 wily	Not affected
	15.04 vivid	Fixed 1.12.1+g01b65bf-4+deb8u3build0.15.04.1
	14.04 LTS trusty	Fixed 2.6.3-1~ubuntu14.04.1
	12.04 LTS precise	Ignored end of life

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Other references

https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=655b0dc623e29da212be3e205314624fe3182562
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=43c2e5769a17f0945fdcdabe35204a13ca9bbc85
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=31571144be5f03f054a9c7e195b38c2f5792fe54
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11389
http://www.wireshark.org/security/wnpa-sec-2015-24.html
https://www.cve.org/CVERecord?id=CVE-2015-6244