Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2011-0538: Wireshark may crash when opening crafted pcap‑ng files
CVE-2011-0538 · published 15 years ago
Summary
Versions of Wireshark that handle .pcap files in the pcap‑ng format can free memory that was never set up, causing the program to stop working. An attacker could send a specially made capture file that triggers this behavior, leading to a crash or other unexpected effects. Update to a newer Wireshark release or avoid opening untrusted capture files to protect your system.
What to do
- Update debian wireshark to version 1.4.3-3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | wireshark |
< 1.4.3-3 Fix: upgrade to 1.4.3-3
|
| Debian:13 | debian | wireshark |
< 1.4.3-3 Fix: upgrade to 1.4.3-3
|
| Debian:14 | debian | wireshark |
< 1.4.3-3 Fix: upgrade to 1.4.3-3
|
| – | wireshark | wireshark |
1.2.0 1.2.1 1.2.2 1.2.3 1.2.4 1.2.5 1.2.6 1.2.7 1.2.8 1.2.9 1.2.10 1.2.11 8 more version ranges
cpe:2.3:a:wireshark:wireshark:1.2.0:*:*:*:*:*:*:* |
Original advisory text
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denia...
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.
References
- https://security-tracker.debian.org/tracker/CVE-2011-0538 Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055364.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055650.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055664.html
- http://openwall.com/lists/oss-security/2011/02/04/1 Patch
- http://secunia.com/advisories/43759 Vendor Advisory
- http://secunia.com/advisories/43795 Vendor Advisory
- http://secunia.com/advisories/43821 Vendor Advisory
- http://www.debian.org/security/2011/dsa-2201
- http://www.kb.cert.org/vuls/id/215900 US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:044
- http://www.redhat.com/support/errata/RHSA-2011-0369.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2011-0370.html Vendor Advisory
- http://www.securityfocus.com/bid/46167 Exploit
- http://www.securitytracker.com/id?1025148
- http://www.vupen.com/english/advisories/2011/0622 Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0626 Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0719 Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0747 Vendor Advisory
- http://www.wireshark.org/docs/relnotes/wireshark-1.2.15.html
- http://www.wireshark.org/docs/relnotes/wireshark-1.4.4.html
- http://www.wireshark.org/security/wnpa-sec-2011-03.html
- http://www.wireshark.org/security/wnpa-sec-2011-04.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5652 Exploit Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=676232
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65182
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
Severity
6.8
Medium
Type
CWE-119Buffer Overflow
Timeline
Published8 Feb 2011
Updated15 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta