Skip to content
OpenAdvisories
Unscored CVE-2016-2525 EUVD-2016-3603GHSA-mvhm-3q9r-jvrj

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allo…

Published Feb 28, 2016 · Updated Aug 5, 2024 · Assigned by mitre

Description

epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 wireshark 2.0.2+ga16e22e-1 —
Debian 13 wireshark 2.0.2+ga16e22e-1 —
Debian 12 wireshark 2.0.2+ga16e22e-1 —
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS wireshark 2.6.3-1~ubuntu18.04.1 —
Ubuntu 16.04 LTS wireshark 2.6.3-1~ubuntu16.04.1 —
Ubuntu 14.04 LTS wireshark 2.6.3-1~ubuntu14.04.1 —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed wireshark 2.2.2-1.1 openSUSE-SU-2024:10199-1

Advisories 1

References