CVE-2019-12295

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/108464Broken Link
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15778Issue Tracking, Patch, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7b6e197da4c497e229ed3ebf6952bae5c426a820
https://lists.debian.org/debian-lts-announce/2020/10/msg00036.htmlMailing List, Third Party Advisory
https://support.f5.com/csp/article/K06725231Third Party Advisory
https://support.f5.com/csp/article/K06725231?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4133-1/Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2019-19.htmlVendor Advisory
http://www.securityfocus.com/bid/108464Broken Link
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15778Issue Tracking, Patch, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7b6e197da4c497e229ed3ebf6952bae5c426a820
https://lists.debian.org/debian-lts-announce/2020/10/msg00036.htmlMailing List, Third Party Advisory
https://support.f5.com/csp/article/K06725231Third Party Advisory
https://support.f5.com/csp/article/K06725231?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4133-1/Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2019-19.htmlVendor Advisory

Timeline

Published: May 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-122979.8An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachab CVE-2019-122985.5Leanify 0.4.3 allows remote attackers to trigger an out-of-bounds write (1024 bytes) via a modified input file.CVE-2019-122996.1Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.CVE-2019-12306.8An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate CVE-2019-123009.8Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an CVE-2019-123019.8The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank CVE-2019-123038.8In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside th CVE-2019-123056.5In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration CVE-2019-123086.1An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by CVE-2019-123094.9dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the i CVE-2019-12315.9An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information CVE-2019-123109.8ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remot