It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-079 advisory.

    A NULL pointer exception flaw was found in Wireshark. A process failure on crafted or malformed input in     the IPPUSB dissector can cause a denial of service via a packet injection or a crafted capture file.
    (CVE-2021-39920)

    A NULL pointer exception flaw was found in Wireshark. A process failure on crafted or malformed input in     the Modbus dissector can cause a denial of service via a packet injection or crafted capture file.
    (CVE-2021-39921)

    A flaw was found in Wireshark. A process failure on crafted or malformed ANSI C12.22  input can cause a     denial of service via packet injection or a crafted capture file. (CVE-2021-39922)

    A flaw was found in Wireshark. A process failure consumes excessive CPU resources on crafted or malformed     PNRP input and can cause a denial of service. (CVE-2021-39923)

    A flaw was found in Wireshark. A process failure on crafted or malformed Bluetooth DHT input can cause a     denial of service via packet injection or a crafted capture file. (CVE-2021-39924)

    A flaw was found in Wireshark. A process failure on crafted or malformed Bluetooth SDP input can cause a     denial of service via packet injection or a crafted capture file. (CVE-2021-39925)

    A flaw was found in Wireshark. A process failure on crafted or malformed HCI_ISO input can cause a denial     of service via packet injection or a crafted capture file. (CVE-2021-39926)

    A flaw was found in Wireshark. A process failure on crafted or malformed IEEE 802.11 input can cause a     denial of service via packet injection or a crafted capture file. (CVE-2021-39928)

    A flaw was found in Wireshark.  A process failure on crafted or malformed  Bluetooth DHT input can cause a     denial of service. (CVE-2021-39929)

    A denial of service via packet injection flaw was found in wireshark. An attacker with local network     access could pass specially crafted capture files causing an application to halt or crash, leading to a     denial of service. (CVE-2021-4181)

    A parser infinite-loop flaw was found in wireshark. An attacker with local network access could pass     specially crafted capture files causing an application to halt, crash, or infinite loop. (CVE-2021-4182)

    An infinite-loop flaw was found in Wireshark's DHT dissector module. This flaw allows an attacker with     local network access to pass specially crafted capture files, causing an application to halt, crash or go     into an infinite loop. (CVE-2021-4184)

    An infinite-loop flaw was found in Wireshark RTMPT. This flaw allows an attacker with local network access     to pass specially crafted capture files, causing an application to halt, crash, or go into an infinite     loop. (CVE-2021-4185)

    A segmentation issue was found in Wireshark. This flaw allows an attacker with local network access to     pass specially crafted capture files, causing an application to halt or crash. (CVE-2021-4186)

    An infinite-loop flaw was found in Wireshark. This flaw allows an attacker with local network access to     pass specially crafted capture files, causing an application to halt, crash, or go into an infinite loop.
    (CVE-2021-4190)

    Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0581)

    Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows     denial of service via packet injection or crafted capture file (CVE-2022-0582)

    Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0583)

    Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial     of service via packet injection or crafted capture file (CVE-2022-0585)

    Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0586)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-3.6.2 advisory.

  - Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0586)

  - Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial     of service via packet injection or crafted capture file (CVE-2022-0585)

  - Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0583)

  - Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows     denial of service via packet injection or crafted capture file (CVE-2022-0582)

  - Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0581)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote Windows host is prior to 3.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-3.6.2 advisory.

  - Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0586)

  - Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial     of service via packet injection or crafted capture file (CVE-2022-0585)

  - Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0583)

  - Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows     denial of service via packet injection or crafted capture file (CVE-2022-0582)

  - Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0581)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7552-1 advisory.

    It was discovered that Wireshark did not correctly handle recursion. If a user or system were tricked into     opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service.
    This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2021-39929)

    Roman Donchenko discovered that Wireshark did not correctly handle parsing certain files. If a user or     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-4182)

    It was discovered that Wireshark did not correctly handle parsing certain files. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04     LTS. (CVE-2021-4185, CVE-2022-0581)

    It was discovered that Wireshark did not correctly handle parsing certain files. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-4186)

    Sharon Brizinov discovered that Wireshark did not correctly handle parsing certain files. If a user or     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS     and Ubuntu 20.04 LTS. (CVE-2022-0582, CVE-2022-0583, CVE-2022-0586)

    Sharon Brizinov discovered that Wireshark did not correctly handle parsing certain files. If a user or     system were tricked into opening a specially crafted file, an attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-0585)

    Jason Cohen discovered that Wireshark did not correctly handle parsing certain files. If a user or system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-3190)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
164754	Amazon Linux 2022 : wireshark-cli, wireshark-devel (ALAS2022-2022-079)	Nessus	Amazon Linux Local Security Checks	9/6/2022	12/11/2024	critical
158991	Wireshark 3.6.x < 3.6.2 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	3/16/2022	3/30/2026	critical
158992	Wireshark 3.6.x < 3.6.2 Multiple Vulnerabilities	Nessus	Windows	3/16/2022	3/30/2026	critical
237869	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Wireshark vulnerabilities (USN-7552-1)	Nessus	Ubuntu Local Security Checks	6/5/2025	6/5/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical