Description
A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | wireshark-cli +1 | 1:4.4.2-1.amzn2023.0.1 | ALAS2023-2025-837 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | wireshark | 4.4.7-1 | — |
| Azure Linux 2 (CBL-Mariner) | wireshark | No fix yet | — |
Advisories 2
- ALAS2023-2025-837 Moderate: wireshark security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 9, 2025
- WID-SEC-2024-0448 Wireshark: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Mar 5, 2024