Description
wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wireshark | 1.6.5-1 | — |
| Debian 13 | wireshark | 1.6.5-1 | — |
| Debian 12 | wireshark | 1.6.5-1 | — |
| Debian 6.0 | wireshark | 1.2.11-6+squeeze6 | DSA-2395-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | wireshark +2 | 1.2.15-2.el6_2.1 | RHSA-2012:0509 |
| RHEL 5 | wireshark +1 | 1.0.15-5.el5 | RHSA-2013:0125 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Wireshark - Buffer Underflow / Denial of Service EDB-36633 · dos · Jan 10, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2013:0125 Red Hat Security Advisory: wireshark security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0509 Red Hat Security Advisory: wireshark security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2395-1 wireshark - buffer underflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://anonsvn.wireshark.org/viewvc?view=revision&revision=40167
- [oss-security] 20120119 Re: CVE request: Wireshark multiple vulnerabilities mailing-list
- 54425 third-party-advisory
- RHSA-2013:0125 vendor-advisory
- http://www.wireshark.org/security/wnpa-sec-2012-01.html
- 48947 third-party-advisory
- oval:org.mitre.oval:def:15192 vdb-entry signature
- [oss-security] 20120111 Re: CVE request: Wireshark multiple vulnerabilities mailing-list
- 47494 third-party-advisory
- GLSA-201308-05 vendor-advisory
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668