CVE-2018-19623

Name	CVE-2018-19623
Description	In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could write arbitrary data to any memory locations before the packet-scoped memory. This was addressed in epan/dissectors/packet-lbmpdm.c by disallowing certain negative values.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-1634-1, DSA-4359-1
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wireshark (PTS)	stretch	2.6.7-1~deb9u1	fixed
	stretch (security)	2.6.20-0+deb9u1	fixed
	buster	2.6.20-0+deb10u1	fixed
	bullseye	3.4.4-1	fixed
	bookworm, sid	3.4.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
wireshark	source	jessie	1.12.1+g01b65bf-4+deb8u16	DLA-1634-1
wireshark	source	stretch	2.6.5-1~deb9u1	DSA-4359-1
wireshark	source	(unstable)	2.6.5-1

Notes

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=9c8645ec7b28e4d7193962ecd2a418613bf6a84f
https://www.wireshark.org/security/wnpa-sec-2018-53.html