CVE-2023-1994: 
Wireshark vulnerability analysis and mitigation

The vulnerability identified as CVE-2023-1994 affects the GQUIC dissector in Wireshark versions 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12. This security flaw allows for a denial of service condition through either packet injection or the use of a crafted capture file (NVD, Wireshark Advisory).

The vulnerability specifically affects the GQUIC (Google Quick UDP Internet Connections) dissector component in Wireshark. The issue manifests as a crash in the dissectgquicframe_type function, as revealed by AddressSanitizer analysis which shows a SEGV (segmentation violation) occurring on an unknown address during memory read operations (Wireshark Issue).

When exploited, this vulnerability can cause Wireshark to crash, resulting in a denial of service condition. The impact can be triggered in two ways: either through the injection of malformed packets into a network being monitored by Wireshark, or by convincing a user to open a specially crafted packet trace file (Wireshark Advisory).

The vulnerability has been patched in Wireshark versions 4.0.5 and 3.6.13. Users are advised to upgrade to these or later versions to mitigate the risk. The fix has been distributed through various Linux distributions including Debian, Fedora, and Gentoo (Debian Security, Fedora Update, Gentoo Security).