CVE-2021-39920
CVE-2021-39920
This page contains facts from public vulnerability sources. Check the original advisory before updating.
NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file
CVSS 7.5 · High · EPSS 3.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
wireshark
- Versions
- >=3.4.0, <3.4.10: Affected
No fix published
wireshark Debian:12
- Affected ranges
- ECOSYSTEM: < 3.6.0-1
Update to 3.6.0-1
wireshark Debian:13
- Affected ranges
- ECOSYSTEM: < 3.6.0-1
Update to 3.6.0-1
wireshark Debian:14
- Affected ranges
- ECOSYSTEM: < 3.6.0-1
Update to 3.6.0-1
wireshark Ubuntu:Pro:14.04:LTS
- Versions
- 1.10.2-1
- 1.10.3-1
- 1.10.5-1ubuntu1
- 1.10.5-2
- 1.10.6-1
- 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1
- 2.6.3-1~ubuntu14.04.1
- 2.6.4-2~ubuntu14.04.1
- 2.6.5-1~ubuntu14.04.1
- 2.6.6-1~ubuntu14.04.0
- 2.6.8-1~ubuntu14.04.0~esm1
- 2.6.10-1~ubuntu14.04.0~esm1
- 2.6.10-1~ubuntu14.04.0~esm2
- 2.6.10-1~ubuntu14.04.0~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:Pro:16.04:LTS
- Versions
- 1.12.7+g7fc8978-1
- 1.12.8+g5b6e543-2
- 2.0.1+g59ea380-3build1
- 2.0.2+ga16e22e-1
- 2.2.6+g32dac6a-2ubuntu0.16.04
- 2.6.3-1~ubuntu16.04.1
- 2.6.4-2~ubuntu16.04.0
- 2.6.5-1~ubuntu16.04.0
- 2.6.6-1~ubuntu16.04.0
- 2.6.8-1~ubuntu16.04.0
- 2.6.10-1~ubuntu16.04.0
- 2.6.10-1~ubuntu16.04.0+esm1
- 2.6.10-1~ubuntu16.04.0+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:Pro:18.04:LTS
- Versions
- 2.4.2-1
- 2.4.3-1
- 2.4.4-1
- 2.4.5-1
- 2.6.3-1~ubuntu18.04.1
- 2.6.4-2~ubuntu18.04.0
- 2.6.5-1~ubuntu18.04.0
- 2.6.6-1~ubuntu18.04.0
- 2.6.8-1~ubuntu18.04.0
- 2.6.10-1~ubuntu18.04.0
- 2.6.10-1~ubuntu18.04.0+esm1
- 2.6.10-1~ubuntu18.04.0+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:Pro:20.04:LTS
- Versions
- 3.0.5-1
- 3.0.7-1
- 3.2.1-1
- 3.2.2-1
- 3.2.3-1
- 3.2.3-1ubuntu0.1~esm1
- 3.2.3-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:Pro:22.04:LTS
- Versions
- 3.4.7-1~exp1
- 3.4.9-1
- 3.6.2-1ubuntu1
- 3.6.2-2
- 3.6.2-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:24.04:LTS
- Versions
- 4.0.8-1
- 4.0.10-1
- 4.0.11-1
- 4.2.0-1
- 4.2.2-1
- 4.2.2-1.1build1
- 4.2.2-1.1build2
- 4.2.2-1.1build3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:25.10
- Versions
- 4.4.5-1
- 4.4.6-2
- 4.4.6-2build1
- 4.4.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:26.10
- Versions
- 4.6.4-1
- 4.6.6-1
- 4.6.6-2
- 4.6.6-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wireshark Ubuntu:26.04:LTS
- Versions
- 4.4.7-1
- 4.6.0-1
- 4.6.1-2
- 4.6.2-3
- 4.6.3-1
- 4.6.4-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://www.wireshark.org/security/wnpa-sec-2021-15.html
- https://gitlab.com/wireshark/wireshark/-/issues/17705
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39920.json
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YEWTIRMC2MFQBZ2O5M4CJHJM4JPBHLXH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6AJFIYIHS3TYDD2EBYBJ5KKE52X34BJ/
- https://www.debian.org/security/2021/dsa-5019
- https://security.gentoo.org/glsa/202210-04
- https://nvd.nist.gov/vuln/detail/CVE-2021-39920