CVE-2023-1994 - wireshark: GQUIC dissector crash

MEDIUM

wireshark: GQUIC dissector crash

Published Apr 12, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 1.00%

GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
>=3.6.0, <3.6.13	affected	-
>=4.0.0, <4.0.5	affected	-

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	wireshark	Out of support scope	n/a
Red Hat Enterprise Linux 7	wireshark	Out of support scope	n/a
Red Hat Enterprise Linux 8	wireshark	Fix deferred	n/a
Red Hat Enterprise Linux 9	wireshark	Fix deferred	n/a

No remediation recorded yet.

Weaknesses (3)

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

CWE-476

NULL Pointer Dereference

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-1994		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2186325		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24174		Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1994.json		Third Party Advisory
https://gitlab.com/wireshark/wireshark/-/issues/18947		ExploitIssue TrackingVendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00029.html		mailing-listMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EHLTD25WNQSPQNELX52UH6YLP4TBLKTT/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZA7IMATNNQPLIM6WMRPM3T5ZY24NRR2/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PFJERBHVWYLYWXO2B3V47QH66IEB6EZ3/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-1994
https://security.gentoo.org/glsa/202309-02		vendor-advisoryThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-1994
https://www.debian.org/security/2023/dsa-5429		vendor-advisoryThird Party Advisory
https://www.wireshark.org/security/wnpa-sec-2023-11.html		Vendor Advisory