CVE-2020-25866

In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncompressed) messages. This was addressed in epan/dissectors/packet-blip.c by allowing reasonable compression ratios and rejecting ZIP bombs.

• CWE-476

• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.htmlMailing List, Third Party Advisory
• https://gitlab.com/wireshark/wireshark/-/commit/4a948427100b6c109f4ec7b4361f0d2aec5e5c3fPatch, Third Party Advisory
• https://gitlab.com/wireshark/wireshark/-/issues/16866Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUHMK5HYTUUDXA64T2TAMAFMYV674QBW/
• https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
• https://www.wireshark.org/security/wnpa-sec-2020-13.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.htmlMailing List, Third Party Advisory
• https://gitlab.com/wireshark/wireshark/-/commit/4a948427100b6c109f4ec7b4361f0d2aec5e5c3fPatch, Third Party Advisory
• https://gitlab.com/wireshark/wireshark/-/issues/16866Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUHMK5HYTUUDXA64T2TAMAFMYV674QBW/
• https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
• https://www.wireshark.org/security/wnpa-sec-2020-13.htmlVendor Advisory

Published

Oct 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25859The QCMAP_CLI utility in the Qualcomm QCMAP software suite p…6.7
• CVE-2020-2586Vulnerability in the Oracle Human Resources product of Oracl…9.9
• CVE-2020-25860The install.c module in the Pengutronix RAUC update client p…6.6
• CVE-2020-25862In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2…7.5
• CVE-2020-25863In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2…7.5
• CVE-2020-25864HashiCorp Consul and Consul Enterprise up to version 1.9.4 k…6.1
• CVE-2020-25867SoPlanning before 1.47 doesn't correctly check the security …5.3
• CVE-2020-25868Pexip Infinity 22.x through 24.x before 24.2 has Improper In…7.5
• CVE-2020-25869An information leak was discovered in MediaWiki before 1.31.…7.5
• CVE-2020-2587Vulnerability in the Oracle Human Resources product of Oracl…9.9
• CVE-2020-25870Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-25872A vulnerability exists within the FileManagerController.php …4.9