CVE-2013-2488

The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.

• CWE-20

• http://anonsvn.wireshark.org/viewvc?view=revision&revision=48011Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-03/msg00065.html
• http://lists.opensuse.org/opensuse-updates/2013-03/msg00077.html
• http://secunia.com/advisories/52471
• http://www.debian.org/security/2013/dsa-2644
• http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.htmlVendor Advisory
• http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.htmlVendor Advisory
• http://www.wireshark.org/security/wnpa-sec-2013-22.htmlVendor Advisory
• https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16672
• http://anonsvn.wireshark.org/viewvc?view=revision&revision=48011Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-03/msg00065.html
• http://lists.opensuse.org/opensuse-updates/2013-03/msg00077.html
• http://secunia.com/advisories/52471
• http://www.debian.org/security/2013/dsa-2644
• http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.htmlVendor Advisory
• http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.htmlVendor Advisory
• http://www.wireshark.org/security/wnpa-sec-2013-22.htmlVendor Advisory
• https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8380
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16672

Published

Mar 7, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-2482The AMPQ dissector in Wireshark 1.6.x before 1.6.14 and 1.8.…
• CVE-2013-2483The acn_add_dmp_data function in epan/dissectors/packet-acn.…
• CVE-2013-2484The CIMD dissector in Wireshark 1.6.x before 1.6.14 and 1.8.…
• CVE-2013-2485The FCSP dissector in Wireshark 1.6.x before 1.6.14 and 1.8.…
• CVE-2013-2486The dissect_diagnosticrequest function in epan/dissectors/pa…
• CVE-2013-2487epan/dissectors/packet-reload.c in the REsource LOcation And…
• CVE-2013-2492Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 …
• CVE-2013-2493The Hook_Terminate function in chrome_frame/protocol_sink_wr…
• CVE-2013-2494libdns in ISC DHCP 4.2.x before 4.2.5-P1 allows remote name …
• CVE-2013-2495The iff_read_header function in iff.c in libavformat in FFmp…
• CVE-2013-2496The msrle_decode_8_16_24_32 function in msrledec.c in libavc…
• CVE-2013-2498SQL injection vulnerability in the login page in flexycms/mo…