Red Hat Security Advisory

RHSA-2014:0341

wireshark security update

Released 2014-03-31 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) wireshark-1.0.15-6.el5_10, wireshark-1.0.15-6.el5_10.i386, wireshark-1.0.15-6.el5_10.ia64 +5
Red Hat Enterprise Linux Desktop (v. 5 client) wireshark-1.0.15-6.el5_10, wireshark-1.0.15-6.el5_10.i386
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) wireshark-1.0.15-6.el5_10, wireshark-gnome-1.0.15-6.el5_10, wireshark-gnome-1.0.15-6.el5_10.i386

Fixes 18 records

TI-2014-01823 CVE-2014-2299 · GHSA-89xx-9cg2-c9fg

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in…

HIGH 70

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (app…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.47143 Published 2014-03-11 Fixed CWE-119

TI-2013-04307 CVE-2013-4927 · GHSA-xg57-xmq9-gj9x

Integer signedness error in the get_type_length function in…

MEDIUM 40

Integer signedness error in the get_type_length function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.037 Published 2013-07-29 Fixed CWE-189

TI-2013-04313 CVE-2013-4933 · GHSA-x3q2-rj77-346x

The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x…

LOW 29

The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of servic…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03269 Published 2013-07-29 Fixed CWE-119

TI-2013-04312 CVE-2013-4932 · GHSA-r37v-5fq8-pq28

Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common…

LOW 29

Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03269 Published 2013-07-29 Fixed CWE-20

TI-2013-04311 CVE-2013-4931 · GHSA-w63x-mh5r-pqpj

epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote…

LOW 29

epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03269 Published 2013-07-29 Fixed CWE-399

TI-2013-03567 CVE-2013-4083 · GHSA-gfcp-27qx-fm2v

The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector…

LOW 29

The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.6.x before 1.6.16, 1.8.x before 1.8.8, and 1.10.0 does not validate a certain fragment length value, which allows rem…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03279 Published 2013-06-09 Fixed CWE-20

TI-2013-03565 CVE-2013-4081 · GHSA-prrm-974p-fp53

The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP…

LOW 29

The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which al…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03298 Published 2013-06-09 Fixed CWE-119

TI-2013-03108 CVE-2013-3559 · GHSA-rp3j-p7r8-f22v

epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before…

LOW 29

epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0332 Published 2013-05-25 Fixed CWE-189

TI-2013-03106 CVE-2013-3557 · GHSA-hp72-9f76-93p7

The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER…

LOW 29

The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote atta…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0332 Published 2013-05-25 Fixed CWE-119

TI-2012-05026 CVE-2012-6062 · GHSA-cprv-qq49-f798

The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in…

LOW 28

The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a craf…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02918 Published 2012-12-05 Fixed CWE-20

TI-2012-05025 CVE-2012-6061 · GHSA-9q6q-c432-4qxj

The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in…

LOW 28

The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote att…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02742 Published 2012-12-05 Fixed CWE-189

TI-2012-05024 CVE-2012-6060 · GHSA-387q-w9v4-q6qm

Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in…

LOW 28

Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (in…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02742 Published 2012-12-05 Fixed CWE-189

TI-2012-05020 CVE-2012-6056 · GHSA-xg25-46f7-mw38

Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in…

LOW 28

Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafte…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02662 Published 2012-12-05 Fixed CWE-189

TI-2013-05843 CVE-2013-7112 · GHSA-cg8f-5cjp-f63j

The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in…

LOW 27

The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a deni…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02307 Published 2013-12-19 Fixed CWE-20

TI-2014-01808 CVE-2014-2281 · GHSA-c3gc-q6xc-6hv4

The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector…

LOW 25

The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02939 Published 2014-03-11 Fixed CWE-20

TI-2013-04315 CVE-2013-4935 · GHSA-5v82-3mrc-p2hg

The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1…

LOW 25

The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situa…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02745 Published 2013-07-29 Fixed CWE-189

TI-2013-04314 CVE-2013-4934 · GHSA-wwxr-cw76-9c5x

The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x…

LOW 25

The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members, which allows remote attackers to cause a deni…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02886 Published 2013-07-29 Fixed CWE-119

TI-2013-04873 CVE-2013-5721 · GHSA-c752-mx4v-mfxw

The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in…

LOW 23

The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop, which allows remote attack…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01669 Published 2013-09-13 Fixed CWE-20