The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Vector
NETWORK
Complexity
LOW
Authentication
NONE
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL
Wireshark 1.10.7
Wireshark 1.12.4
Wireshark 1.10.6
Wireshark Wireshark 1.12.1 (not an official CPE)
Wireshark 1.10.3
Wireshark Wireshark 1.12.0 (not an official CPE)
Wireshark Wireshark 1.10.2
Wireshark Wireshark 1.10.11
Wireshark 1.10.8
Wireshark 1.10.9
Wireshark 1.10.12
Wireshark Wireshark 1.10.10 (not an official CPE)
Wireshark 1.12.3
Wireshark 1.10.5
Wireshark Wireshark 1.12.2
Wireshark 1.10.4
Wireshark 1.10.13
Wireshark 1.10.14
Wireshark Wireshark 1.10.1
Wireshark 1.10.0