9.3

CVE-2014-2299: wireshark

CVSS: 9.3v2.0HighModified
AliasesUBUNTU-CVE-2014-2299DEBIAN-CVE-2014-2299
Published 11-03-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-2299 is a high (CVSS 9.3) vulnerability in wireshark. EPSS estimates a 47.14% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.3/10
010
High · v2.0 (NVD)
EPSS score
47.14%
0%100%
High · -0.28 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 6 · Related 1
DSA-2871-1MGASA-2014-0125MGASA-2014-0126OPENSUSE-SU-2024:10199-1RHSA-2014:0341RHSA-2014:0342

Timeline

  1. 11-03-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

47.14%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

-0.28 pp

From 47.42% on 19-09-2026

19-09-202619-10-2026
EPSS score
47.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • exploit-databaselocalwindowsVerified

    Wireshark 1.8.12/1.10.5 - wiretap/mpeg.c Stack Buffer Overflow (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    Wireshark wiretap/mpeg.c Stack Buffer Overflow

    exploit/windows/fileformat/wireshark_mpeg_overflow

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • wireshark< 1.10.6-1
Ubuntu1 product
  • wireshark< 1.10.6-1
Wireshark1 product
  • wiresharkEOL1.8.0 | 1.8.1 | 1.8.2 | 1.8.3 | 1.8.4 | 1.8.5 | 1.8.6 | 1.8.7 | 1.8.8 | 1.8.9 | 1.8.10 | 1.8.11 | 1.8.12 | 1.10.0 | 1.10.1 | 1.10.2 | 1.10.3 | 1.10.4 | 1.10.5

3 vendors · 3 products

References

19 links
Show all 19 references