CVE-2006-4574: wireshark Off-by-one Error
CVSS: 7.5v3.1HighModified
AliasesDEBIAN-CVE-2006-4574
Published 28-10-2006Last modified 17-01-2025
Some data may be incomplete
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2006-4574 is a high (CVSS 7.5) Off-by-one Error vulnerability in wireshark. EPSS estimates a 4.42% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
4.42%
0%100%
Low · +0.22 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 28-10-2006PublishedVulnerability first disclosed.
- 17-01-2025Last modifiedVulnerability information updated.
Description
Off-by-one error in the MIME Multipart dissector in Wireshark (formerly Ethereal) 0.10.1 through 0.99.3 allows remote attackers to cause a denial of service (crash) via certain vectors that trigger an assertion error related to unexpected length values.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.42%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
+0.22 pp
From 4.20% on 19-09-2026
19-09-202619-10-2026
EPSS score4.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Debian1 product
- wireshark< 0.99.4-1
Wireshark1 product
- wireshark≥ 0.10.1, ≤ 0.99.3
2 vendors · 2 products
References
22 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9740VDB EntrySignatureX Refsource OVALBroken Link
Show all 22 references
- www.novell.com/linux/security/advisories/2006_65_ethereal.htmlVendor AdvisoryX Refsource SUSEBroken Link
- www.securityfocus.com/archive/1/450307/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- www.mandriva.com/security/advisories?name=MDKSA-2006:195Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory