Wireshark vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-24479 A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs compHigh 7.5 · Feb 21, 2024
• CVE-2024-24476 A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size comHigh 7.5 · Feb 21, 2024
• CVE-2024-24478 An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, pHigh 7.5 · Feb 21, 2024
• CVE-2020-28030 In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash.High 7.5 · Nov 2, 2020
• CVE-2020-26575 In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop.High 7.5 · Oct 6, 2020
• CVE-2020-25866 In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncomHigh 7.5 · Oct 6, 2020
• CVE-2020-25863 In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash.High 7.5 · Oct 6, 2020
• CVE-2020-25862 In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash.High 7.5 · Oct 6, 2020
• CVE-2020-15466 In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop.High 7.5 · Jul 5, 2020
• CVE-2020-13164 In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash.High 7.5 · May 19, 2020
• CVE-2020-11647 In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash.High 7.5 · Apr 10, 2020
• CVE-2020-9431 In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory.High 7.5 · Feb 27, 2020
• CVE-2020-9430 In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash.High 7.5 · Feb 27, 2020
• CVE-2020-9429 In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash.High 7.5 · Feb 27, 2020
• CVE-2020-9428 In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash.High 7.5 · Feb 27, 2020
• CVE-2020-7044 In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash.High 7.5 · Jan 15, 2020
• CVE-2019-19553 In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash.High 7.5 · Dec 4, 2019
• CVE-2019-16319 In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop.High 7.5 · Sep 15, 2019
• CVE-2019-13619 In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash.High 7.5 · Jul 17, 2019
• CVE-2019-12295 In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash.High 7.5 · May 23, 2019
• CVE-2019-10903 In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash.High 7.5 · Apr 9, 2019
• CVE-2019-10902 In Wireshark 3.0.0, the TSDNS dissector could crash.High 7.5 · Apr 9, 2019
• CVE-2019-10901 In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash.High 7.5 · Apr 9, 2019
• CVE-2019-10900 In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop.High 7.5 · Apr 9, 2019
• CVE-2019-10899 In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash.High 7.5 · Apr 9, 2019