CVE-2018-7419

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP dissector could crash. This was addressed in epan/dissectors/asn1/nbap/nbap.cnf by ensuring DCH ID initialization.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-665

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/103159Third Party Advisory, VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14443Issue Tracking, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=bebd3a1f50b0a27738d8d3da5b33c1b392eb7273
https://lists.debian.org/debian-lts-announce/2018/04/msg00018.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4217Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2018-14.htmlVendor Advisory
http://www.securityfocus.com/bid/103159Third Party Advisory, VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14443Issue Tracking, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=bebd3a1f50b0a27738d8d3da5b33c1b392eb7273
https://lists.debian.org/debian-lts-announce/2018/04/msg00018.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4217Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2018-14.htmlVendor Advisory

Timeline

Published: Feb 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-74207.5In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the pcapng file parser could crash. This was addressed in wiretap/pcapng.c by adding a bloc CVE-2018-74217.5In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the DMP dissector could go into an infinite loop. This was addressed in epan/dissectors/pac CVE-2018-74227.5A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary fil CVE-2018-74276.1Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.14, 6 CVE-2018-74297.5Splunkd in Splunk Enterprise 6.2.x before 6.2.14 6.3.x before 6.3.11, and 6.4.x before 6.4.8; and Splunk Light before 6.5.0 allow remote att CVE-2018-74316.5Directory traversal vulnerability in the Splunk Django App in Splunk Enterprise 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.1 CVE-2018-74327.5Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow CVE-2018-74337.5The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.CVE-2018-74345.3zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucent CVE-2018-74358.8An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function.CVE-2018-74368.8An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer dereference of the parse_SST function.CVE-2018-74378.8An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function.