CVE-2018-11359

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
http://www.securityfocus.com/bid/104308Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041036Third Party Advisory, VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703Issue Tracking, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=beaebe91b14564fb9f86f0726bab09927872721b
https://lists.debian.org/debian-lts-announce/2019/01/msg00010.htmlMailing List, Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2018-33.htmlVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
http://www.securityfocus.com/bid/104308Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041036Third Party Advisory, VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703Issue Tracking, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=beaebe91b14564fb9f86f0726bab09927872721b
https://lists.debian.org/debian-lts-announce/2019/01/msg00010.htmlMailing List, Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2018-33.htmlVendor Advisory

Timeline

Published: May 22, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-11364.3An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is no CVE-2018-113607.5In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-CVE-2018-113617.5In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/dot11decrypt.c by avoiding a buffer ove CVE-2018-113627.5In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c CVE-2018-113637.5jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.CVE-2018-113647.5sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv_o CVE-2018-113657.5sas/readstat_sas7bcat_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop.CVE-2018-113666.1init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS) because logging is CVE-2018-113677.5An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module.CVE-2018-113699.8An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the database via the \apps\home CVE-2018-11378.1An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by us CVE-2018-113718.8SkyCaiji 1.2 allows CSRF to add an Administrator user.