Vulnerabilities > CVE-2023-0666 - Out-of-bounds Write vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 | |
| OS | 1 |
Common Weakness Enumeration (CWE)
References
- https://gitlab.com/wireshark/wireshark/-/issues/19085
- https://gitlab.com/wireshark/wireshark/-/issues/19085
- https://security.gentoo.org/glsa/202309-02
- https://security.gentoo.org/glsa/202309-02
- https://takeonme.org/cves/CVE-2023-0666.html
- https://takeonme.org/cves/CVE-2023-0666.html
- https://www.debian.org/security/2023/dsa-5429
- https://www.debian.org/security/2023/dsa-5429
- https://www.wireshark.org/docs/relnotes/wireshark-4.0.6.html
- https://www.wireshark.org/docs/relnotes/wireshark-4.0.6.html
- https://www.wireshark.org/security/wnpa-sec-2023-18.html
- https://www.wireshark.org/security/wnpa-sec-2023-18.html