CVE-2023-0412

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
Wireshark Foundation	Wireshark	>=4.0.0, <4.0.3; >=3.6.0, <3.6.11

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0412.jsonIssue Tracking
https://gitlab.com/wireshark/wireshark/-/issues/18770Issue Tracking, Patch
https://lists.debian.org/debian-lts-announce/2023/02/msg00007.htmlMailing List, Third Party Advisory
https://www.wireshark.org/security/wnpa-sec-2023-07.htmlVendor Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0412.jsonIssue Tracking
https://gitlab.com/wireshark/wireshark/-/issues/18770Issue Tracking, Patch
https://lists.debian.org/debian-lts-announce/2023/02/msg00007.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html
https://www.wireshark.org/security/wnpa-sec-2023-07.htmlVendor Advisory

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04136.5Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture f CVE-2023-04146.5Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file CVE-2023-04156.5iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture f CVE-2023-04166.5GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture fil CVE-2023-04176.5Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafte CVE-2023-04185.4The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them ba CVE-2023-04195.4The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting CVE-2023-04204.8The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping CVE-2023-04216.1The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, CVE-2023-04224.8The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the a CVE-2023-04234.8The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, l CVE-2023-04245.4The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as S