Security readout for executives and security teams
Plain-English summary
CVE-2018-9273 is a memory leak in Wireshark's PCP packet dissector. Affected Wireshark versions are 2.4.0 through 2.4.5 and 2.2.0 through 2.2.13. The main business concern is disruption or resource exhaustion in systems or analyst workstations that process packet captures, not confirmed data theft.
Executive priority
Treat as a maintenance-priority vulnerability unless Wireshark is used in critical automated analysis pipelines or exposed to untrusted captures at scale. No active exploitation evidence is provided.
Technical view
The issue is in epan/dissectors/packet-pcp.c. The source bundle identifies only a memory leak in affected Wireshark release ranges and links Wireshark, Debian, bug, and commit references. No CVSS, CWE, or detailed exploit preconditions are provided in the bundle.
Likely exposure
Exposure is most likely where vulnerable Wireshark versions are installed on analyst workstations, servers, or automated capture-processing workflows that inspect PCP traffic or packet captures.
Exploitation context
CISA KEV status is false, and the provided sources do not claim active exploitation. The bundle does not provide public exploit details, only a memory-leak vulnerability and remediation references.
Researcher notes
Evidence is limited. The bundle names the vulnerable file, affected versions, Debian advisory, Wireshark advisory, bug record, and commit reference, but omits CVSS, CWE, fixed versions, and detailed trigger conditions.
Mitigation direction
- Inventory Wireshark installations and identify versions in the affected ranges.
- Review Wireshark WNPA-sec-2018-24 for fixed release guidance.
- Apply Debian DSA-4217 updates where Debian packages are used.
- Limit processing of untrusted packet captures until vulnerable installations are updated.
- Check vendor guidance before applying any workaround not named in advisories.
Validation and detection
- Confirm installed Wireshark versions are not 2.4.0-2.4.5 or 2.2.0-2.2.13.
- Verify package update records against Debian DSA-4217 where applicable.
- Check analyst workstations and automated PCAP pipelines, not only servers.
- Review monitoring for unusual memory growth during packet analysis workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-9273 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- DSA-4217CVE reference · vendor-advisory, x_refsource_DEBIAN
- https://www.wireshark.org/security/wnpa-sec-2018-24.htmlCVE reference · x_refsource_MISC
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=1f8f1456f1e73b6c09e50a64749e43413ac12df7CVE reference · x_refsource_MISC
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14488CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.