CVE-2017-5596
Publication date 25 January 2017
Last updated 25 August 2025
Ubuntu priority
Description
In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| wireshark | 18.04 LTS bionic |
Not affected
|
| 16.04 LTS xenial |
Fixed 2.2.6+g32dac6a-2ubuntu0.16.04
|
|
| 14.04 LTS trusty |
Fixed 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1
|
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Other references
- https://www.wireshark.org/security/wnpa-sec-2017-01.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13344
- https://code.wireshark.org/review/#/c/19746/
- https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=781f03580c81339513bb1238b202b72469a1240b
- https://www.cve.org/CVERecord?id=CVE-2017-5596