CVE-2020-25866: fedoraproject fedora NULL Pointer Dereference
Vulnerability summary
CVE-2020-25866 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in fedoraproject fedora. EPSS estimates a 3.99% chance of exploitation in the next 30 days, higher than 90.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 06-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncompressed) messages. This was addressed in epan/dissectors/packet-blip.c by allowing reasonable compression ratios and rejecting ZIP bombs.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.99%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
+0.05 pp
From 3.94% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- wireshark< 3.2.7-1
Fedoraproject1 product
- fedoraEOL31 | 32 | 33
Opensuse1 product
- leapEOL15.1 | 15.2
Oracle1 product
Ubuntu1 product
- wiresharkAll versions (No fix recorded)
Wireshark1 product
- wireshark≥ 3.0.0, ≤ 3.0.13 | ≥ 3.2.0, ≤ 3.2.6
6 vendors · 6 products
References
12 links- gitlab.com/wireshark/wireshark/-/issues/16866X Refsource MISCREPORTExploitIssue TrackingThird Party Advisory
- gitlab.com/wireshark/wireshark/-/commit/4a948427100b6c109f4ec7b4361f0d2aec5e5c3fX Refsource MISCPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
