CVE-2017-7702

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name	Vendor	Start Version	End Version
Wireshark	Wireshark	2.0.0 (including)	2.0.0 (including)
Wireshark	Wireshark	2.0.1 (including)	2.0.1 (including)
Wireshark	Wireshark	2.0.2 (including)	2.0.2 (including)
Wireshark	Wireshark	2.0.3 (including)	2.0.3 (including)
Wireshark	Wireshark	2.0.4 (including)	2.0.4 (including)
Wireshark	Wireshark	2.0.5 (including)	2.0.5 (including)
Wireshark	Wireshark	2.0.6 (including)	2.0.6 (including)
Wireshark	Wireshark	2.0.7 (including)	2.0.7 (including)
Wireshark	Wireshark	2.0.8 (including)	2.0.8 (including)
Wireshark	Wireshark	2.0.9 (including)	2.0.9 (including)
Wireshark	Wireshark	2.0.10 (including)	2.0.10 (including)
Wireshark	Wireshark	2.0.11 (including)	2.0.11 (including)
Wireshark	Wireshark	2.2.0 (including)	2.2.0 (including)
Wireshark	Wireshark	2.2.1 (including)	2.2.1 (including)
Wireshark	Wireshark	2.2.2 (including)	2.2.2 (including)
Wireshark	Wireshark	2.2.3 (including)	2.2.3 (including)
Wireshark	Wireshark	2.2.4 (including)	2.2.4 (including)
Wireshark	Wireshark	2.2.5 (including)	2.2.5 (including)
Wireshark	Ubuntu	artful	*
Wireshark	Ubuntu	bionic	*
Wireshark	Ubuntu	esm-apps/bionic	*
Wireshark	Ubuntu	esm-apps/xenial	*
Wireshark	Ubuntu	esm-infra-legacy/trusty	*
Wireshark	Ubuntu	precise	*
Wireshark	Ubuntu	trusty	*
Wireshark	Ubuntu	trusty/esm	*
Wireshark	Ubuntu	upstream	*
Wireshark	Ubuntu	xenial	*
Wireshark	Ubuntu	yakkety	*
Wireshark	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2017-7702
CWE	https://cwe.mitre.org/data/definitions/835.html

Loop with Unreachable Exit Condition ('Infinite Loop')

Weakness

Affected Software

References