CVE-2024-2955: 
Wireshark vulnerability analysis and mitigation

A vulnerability has been identified in Wireshark's T.38 protocol dissector affecting versions 4.2.0 to 4.2.3 and 4.0.0 to 4.0.13. The vulnerability, tracked as CVE-2024-2955, allows denial of service via packet injection or crafted capture file (Wireshark Advisory). The issue was discovered through internal testing and was disclosed on March 26, 2024.

The vulnerability is classified as CWE-762 (Mismatched Memory Management Routines) and involves a heap-use-after-free condition in the T.38 dissector. The issue occurs when decoding malformed packets from a pcap file or from the network. According to the GitLab issue report, the vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (GitLab Issue).

The vulnerability can cause Wireshark to crash when processing malformed T.38 protocol packets. This can be triggered either by injecting malicious packets into a network or by convincing a user to open a specially crafted capture file (Wireshark Advisory).

The vulnerability was discovered in Wireshark's internal testing environment, and there are no known exploits in the wild. However, the potential for exploitation exists through either network packet injection or malformed capture files (Wireshark Advisory).

The vulnerability has been fixed in Wireshark versions 4.2.4 and 4.0.14. Users are advised to upgrade to these or later versions to mitigate the risk (Wireshark Advisory). The fix has been distributed through various channels, including Fedora's package management system (Fedora Update).