CVE-2018-19623

Published: 29 November 2018

In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could write arbitrary data to any memory locations before the packet-scoped memory. This was addressed in epan/dissectors/packet-lbmpdm.c by disallowing certain negative values.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
wireshark Launchpad, Ubuntu, Debian	Upstream	Released (2.6.5-1)



	Ubuntu 18.04 LTS (Bionic Beaver)	Released (2.6.5-1~ubuntu18.04.0)
	Ubuntu 16.04 LTS (Xenial Xerus)	Released (2.6.5-1~ubuntu16.04.0)
	Ubuntu 14.04 ESM (Trusty Tahr)	Released (2.6.5-1~ubuntu14.04.1)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19623
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=9c8645ec7b28e4d7193962ecd2a418613bf6a84f
https://www.wireshark.org/security/wnpa-sec-2018-53.html
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

CVE-2018-19623

Medium

Status

References

Join the discussion

Canonical is offering Extended Security Maintenance

Further reading