CVE-2018-11355 Memory corruption in n/a
A buffer overflow in the RTCP dissector allows attackers to crash Wireshark, requiring users to update to a patched version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-11355?
CVE-2018-11355 is a high-severity memory corruption vulnerability in Wireshark Wireshark, published on 22 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks.
Weakness: CWE-119
Which versions are affected by CVE-2018-11355?
It affects 1 product.
Products include Wireshark Wireshark.
How do I fix CVE-2018-11355?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-11355 being exploited?
There is no known exploitation of CVE-2018-11355 in the wild and no public exploit code.
Other vulnerabilities in Wireshark Wireshark
Sources
Also known as GHSA-qpcg-222p-49hp.