Description
Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | ettercap | 1:0.8.1-3 | — |
| Debian 12 | ettercap | 1:0.8.1-3 | — |
| Debian 6.0 | ettercap | 1:0.7.3-2.1+squeeze2 | DLA-126-1 |
Advisories 1
- DLA-126-1 ettercap - security update Debian Security (DSA / DLA) · Mar 9, 2026