CVE-2013-2487

Description

epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark 1.8.x before 1.8.6 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via crafted integer values in a packet, related to the (1) dissect_icecandidates, (2) dissect_kinddata, (3) dissect_nodeid_list, (4) dissect_storeans, (5) dissect_storereq, (6) dissect_storeddataspecifier, (7) dissect_fetchreq, (8) dissect_findans, (9) dissect_diagnosticinfo, (10) dissect_diagnosticresponse, (11) dissect_reload_messagecontents, and (12) dissect_reload_message functions, a different vulnerability than CVE-2013-2486.

Risk Information

Base Score

7.5

MODERATE

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

3.511

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities fixed in Wireshark x64 1.8.6	Windows
Multiple vulnerabilities fixed in Wireshark x64 1.8.7	Windows
Multiple vulnerabilities are fixed in Wireshark for Mac 1.8.7	Mac
Multiple vulnerabilities are fixed in Wireshark for Mac 1.8.6	Mac

Patch Details

Click to see the patches provided by ManageEngine for this CVE

Patch ID	Patch Description
PATCH-338541	Wireshark (3.6.24)
PATCH-338541	Wireshark (3.6.24)
PATCH-612949	WireShark for Mac (4.6.2)
PATCH-612949	WireShark for Mac (4.6.2)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234