CVE-2020-26421
MEDIUM severity · CVSS 4.2 · Out-of-bounds read
4.2CVSS MEDIUM
Summary
Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
Impact & exploitability
Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionRequired
Confidentiality impactLow
Integrity impactNone
Availability impactLow
Exploit probability (EPSS)3%
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: https://www.oracle.com/security-alerts/cpuApr2021.html ↗
Additional information
- NVD record
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch
- https://www.wireshark.org/security/wnpa-sec-2020-17.htmlAdvisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26421.jsonAdvisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.htmlAdvisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M75HYXU36SP6GHIDPHNZGJKEO6TX4C4Y/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHWDZPWQJMLK64VFDWJC5SEGPNH6Y72Z/
- https://security.gentoo.org/glsa/202101-12Advisory
- https://gitlab.com/wireshark/wireshark/-/issues/16958Advisory