Infinite Loop Vulnerability in Wireshark WBXML Dissector

CVE-2017-11410 · HIGH Severity

AV:N/AC:L/AU:N/C:N/I:N/A:C

In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding validation of the relationships between indexes and lengths. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-7702.

Learn more about our Web Application Penetration Testing UK.