CVE-2024-2955 - Vulnerability Details - OpenCVE

T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Wireshark	Wireshark

No data.

No data.

References

Link	Providers
https://gitlab.com/wireshark/wireshark/-/issues/19695
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7TWJQKXOV4HYI5C4TWRKTN7B5YL7GTU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZD2MNS6EW2K2SSMN4YBGPZCC47KBDNEE/
https://nvd.nist.gov/vuln/detail/CVE-2024-2955
https://www.cve.org/CVERecord?id=CVE-2024-2955
https://www.wireshark.org/security/wnpa-sec-2024-06.html

History

Thu, 10 Apr 2025 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wireshark Wireshark wireshark
CPEs		cpe:2.3:a:wireshark:wireshark::::::::
Vendors & Products		Wireshark Wireshark wireshark
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2024-03-26T20:02:08.419Z

Updated: 2025-04-10T20:07:56.097Z

Reserved: 2024-03-26T19:02:07.653Z

Link: CVE-2024-2955

Vulnrichment

Updated: 2024-08-01T19:32:42.453Z

NVD

Status : Awaiting Analysis

Published: 2024-03-26T20:15:11.710

Modified: 2024-11-21T09:10:55.577

Link: CVE-2024-2955

Redhat

Severity : Moderate

Publid Date: 2024-03-26T00:00:00Z

Links: CVE-2024-2955 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2955", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2024-03-26T19:02:07.653Z", "datePublished": "2024-03-26T20:02:08.419Z", "dateUpdated": "2025-04-10T20:07:56.097Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.2.4", "status": "affected", "version": "4.2.0", "versionType": "semver"}, {"lessThan": "4.0.14", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-762", "description": "CWE-762: Mismatched Memory Management Routines", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-08-29T15:04:56.788Z"}, "references": [{"tags": ["broken-link"], "url": "https://www.wireshark.org/security/wnpa-sec-2024-06.html"}, {"name": "GitLab Issue #19695", "tags": ["issue-tracking"], "url": "https://gitlab.com/wireshark/wireshark/-/issues/19695"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 4.2.4 or above."}], "title": "Mismatched Memory Management Routines in Wireshark"}, "adp": [{"affected": [{"vendor": "wireshark", "product": "wireshark", "cpes": ["cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.2.0", "status": "affected", "lessThan": "4.2.4", "versionType": "semver"}, {"version": "4.0.0", "status": "affected", "lessThan": "4.0.14", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-17T11:38:47.749899Z", "id": "CVE-2024-2955", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-10T20:07:56.097Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:32:42.453Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2024-06.html", "tags": ["broken-link", "x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/issues/19695", "name": "GitLab Issue #19695", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZD2MNS6EW2K2SSMN4YBGPZCC47KBDNEE/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7TWJQKXOV4HYI5C4TWRKTN7B5YL7GTU/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2024-06.html", "tags": ["broken-link", "x_transferred"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/issues/19695", "name": "GitLab Issue #19695", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZD2MNS6EW2K2SSMN4YBGPZCC47KBDNEE/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7TWJQKXOV4HYI5C4TWRKTN7B5YL7GTU/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:32:42.453Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2955", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-17T11:38:47.749899Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*"], "vendor": "wireshark", "product": "wireshark", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.4", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.14", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T17:40:42.800Z"}}], "cna": {"title": "Mismatched Memory Management Routines in Wireshark", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.4", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 4.2.4 or above."}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2024-06.html", "tags": ["broken-link"]}, {"url": "https://gitlab.com/wireshark/wireshark/-/issues/19695", "name": "GitLab Issue #19695", "tags": ["issue-tracking"]}], "descriptions": [{"lang": "en", "value": "T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-762", "description": "CWE-762: Mismatched Memory Management Routines"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-08-29T15:04:56.788Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2955", "state": "PUBLISHED", "dateUpdated": "2025-04-10T20:07:56.097Z", "dateReserved": "2024-03-26T19:02:07.653Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2024-03-26T20:02:08.419Z", "assignerShortName": "GitLab"}, "dataVersion": "5.1"}