CVE-2017-13766

Publication date 30 August 2017

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
wireshark	18.04 LTS bionic	Fixed 2.6.3-1~ubuntu18.04.1
	17.10 artful	Ignored end of life
	17.04 zesty	Ignored end of life
	16.04 LTS xenial	Fixed 2.6.3-1~ubuntu16.04.1
	14.04 LTS trusty	Fixed 2.6.3-1~ubuntu14.04.1

How can I get the fixes?
What do statuses mean?

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

MITRE
NVD
Launchpad
Debian

Other references

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13847
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=2096bc1e5078732543e0a3ee115a2ce520a72bbc
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=af7b093ca528516c14247acb545046199d30843e
https://www.wireshark.org/security/wnpa-sec-2017-39.html
https://www.cve.org/CVERecord?id=CVE-2017-13766