CVE-2019-5717

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid sequence number of zero.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
http://www.securityfocus.com/bid/106482Third Party Advisory, VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15337Exploit, Issue Tracking, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=bf9272a92f3df1e4ccfaad434e123222ae5313f7
https://lists.debian.org/debian-lts-announce/2019/01/msg00022.htmlThird Party Advisory
https://seclists.org/bugtraq/2019/Mar/35Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4416Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2019-02.htmlVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
http://www.securityfocus.com/bid/106482Third Party Advisory, VDB Entry
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15337Exploit, Issue Tracking, Vendor Advisory
https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=bf9272a92f3df1e4ccfaad434e123222ae5313f7
https://lists.debian.org/debian-lts-announce/2019/01/msg00022.htmlThird Party Advisory
https://seclists.org/bugtraq/2019/Mar/35Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4416Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2019-02.htmlVendor Advisory

Timeline

Published: Jan 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-57185.5In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was addressed in epan/chars CVE-2019-57195.5In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by CVE-2019-57209.8includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the CVE-2019-57215.5In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by changing the memory-man CVE-2019-57229.8An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Due to a lack of user input validation in parameter handling, it has various CVE-2019-57239.8An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Passwords are stored using reversible encryption rather than as a hash value,CVE-2019-57257.5qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a UR CVE-2019-57275.4Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6 CVE-2019-57298.1Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks.CVE-2019-57368.6runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequen CVE-2019-57377.5In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of S CVE-2019-57397.5Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduc