CVE-2014-4020

The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

Affected Software

Name	Vendor	Start Version	End Version
Wireshark	Wireshark	1.10.0 (including)	1.10.0 (including)
Wireshark	Wireshark	1.10.1 (including)	1.10.1 (including)
Wireshark	Wireshark	1.10.2 (including)	1.10.2 (including)
Wireshark	Wireshark	1.10.3 (including)	1.10.3 (including)
Wireshark	Wireshark	1.10.4 (including)	1.10.4 (including)
Wireshark	Wireshark	1.10.5 (including)	1.10.5 (including)
Wireshark	Wireshark	1.10.6 (including)	1.10.6 (including)
Wireshark	Wireshark	1.10.7 (including)	1.10.7 (including)
Wireshark	Ubuntu	bionic	*
Wireshark	Ubuntu	esm-apps/bionic	*
Wireshark	Ubuntu	esm-apps/xenial	*
Wireshark	Ubuntu	esm-infra-legacy/trusty	*
Wireshark	Ubuntu	lucid	*
Wireshark	Ubuntu	saucy	*
Wireshark	Ubuntu	trusty	*
Wireshark	Ubuntu	trusty/esm	*
Wireshark	Ubuntu	upstream	*
Wireshark	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2014-4020
CWE	https://cwe.mitre.org/data/definitions/189.html

Affected Software

References