CVE Vulnerabilities

CVE-2017-7703

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Apr 12, 2017 | Modified: Nov 07, 2023
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
5.9 MODERATE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a lines end correctly.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Wireshark Wireshark 2.0.0 (including) 2.0.0 (including)
Wireshark Wireshark 2.0.1 (including) 2.0.1 (including)
Wireshark Wireshark 2.0.2 (including) 2.0.2 (including)
Wireshark Wireshark 2.0.3 (including) 2.0.3 (including)
Wireshark Wireshark 2.0.4 (including) 2.0.4 (including)
Wireshark Wireshark 2.0.5 (including) 2.0.5 (including)
Wireshark Wireshark 2.0.6 (including) 2.0.6 (including)
Wireshark Wireshark 2.0.7 (including) 2.0.7 (including)
Wireshark Wireshark 2.0.8 (including) 2.0.8 (including)
Wireshark Wireshark 2.0.9 (including) 2.0.9 (including)
Wireshark Wireshark 2.0.10 (including) 2.0.10 (including)
Wireshark Wireshark 2.0.11 (including) 2.0.11 (including)
Wireshark Wireshark 2.2.0 (including) 2.2.0 (including)
Wireshark Wireshark 2.2.1 (including) 2.2.1 (including)
Wireshark Wireshark 2.2.2 (including) 2.2.2 (including)
Wireshark Wireshark 2.2.3 (including) 2.2.3 (including)
Wireshark Wireshark 2.2.4 (including) 2.2.4 (including)
Wireshark Wireshark 2.2.5 (including) 2.2.5 (including)
Wireshark Ubuntu artful *
Wireshark Ubuntu bionic *
Wireshark Ubuntu precise *
Wireshark Ubuntu trusty *
Wireshark Ubuntu upstream *
Wireshark Ubuntu xenial *
Wireshark Ubuntu yakkety *
Wireshark Ubuntu zesty *

Potential Mitigations

References