CVE-2008-3145

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-07-16 · updated 2026-06-16
Weakness: CWE-20

Description

The fragment_add_work function in epan/reassemble.c in Wireshark 0.8.19 through 1.0.1 allows remote attackers to cause a denial of service (crash) via a series of fragmented packets with non-sequential fragmentation offset values, which lead to a buffer over-read.

Affected products

Wireshark Foundation Wireshark: 0.8.19, 0.99.0, 0.99.1, 0.99.2, 0.99.3, 0.99.4 (+8)

References

http://anonsvn.wireshark.org/viewvc/index.py?view=rev&revision=25343
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
http://secunia.com/advisories/31044
http://secunia.com/advisories/31085
http://secunia.com/advisories/31257
http://secunia.com/advisories/31378
http://secunia.com/advisories/31687
http://secunia.com/advisories/32091
http://secunia.com/advisories/32944
http://security.gentoo.org/glsa/glsa-200808-04.xml
http://securitytracker.com/id?1020471
http://support.avaya.com/elmodocs2/security/ASA-2008-392.htm

Get alerted when CVE-2008-3145 or the next vulnerability affects your stack