Описание
Security update for wireshark
The network debugging tool wireshark was updated to version 2.2.7 to fix the following issues:
- CVE-2017-9352: Bazaar dissector infinite loop (wnpa-sec-2017-22) (bsc#1042304)
- CVE-2017-9348: DOF dissector read overflow (wnpa-sec-2017-23) (bsc#1042303)
- CVE-2017-9351: DHCP dissector read overflow (wnpa-sec-2017-24) (bsc#1042302)
- CVE-2017-9346: SoulSeek dissector infinite loop (wnpa-sec-2017-25) (bsc#1042301)
- CVE-2017-9345: DNS dissector infinite loop (wnpa-sec-2017-26) (bsc#1042300)
- CVE-2017-9349: DICOM dissector infinite loop (wnpa-sec-2017-27) (bsc#1042305)
- CVE-2017-9350: openSAFETY dissector memory exh.. (wnpa-sec-2017-28) (bsc#1042299)
- CVE-2017-9344: BT L2CAP dissector divide by zero (wnpa-sec-2017-29) (bsc#1042298)
- CVE-2017-9343: MSNIP dissector crash (wnpa-sec-2017-30) (bsc#1042309)
- CVE-2017-9347: ROS dissector crash (wnpa-sec-2017-31) (bsc#1042308)
- CVE-2017-9354: RGMP dissector crash (wnpa-sec-2017-32) (bsc#1042307)
- CVE-2017-9353: wireshark: IPv6 dissector crash (wnpa-sec-2017-33) (bsc#1042306)
Список пакетов
SUSE Linux Enterprise Desktop 12 SP2
SUSE Linux Enterprise Server 12 SP2
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
SUSE Linux Enterprise Server for SAP Applications 12 SP2
SUSE Linux Enterprise Software Development Kit 12 SP2
Ссылки
- Link for SUSE-SU-2017:1663-1
- E-Mail link for SUSE-SU-2017:1663-1
- SUSE Security Ratings
- SUSE Bug 1042298
- SUSE Bug 1042299
- SUSE Bug 1042300
- SUSE Bug 1042301
- SUSE Bug 1042302
- SUSE Bug 1042303
- SUSE Bug 1042304
- SUSE Bug 1042305
- SUSE Bug 1042306
- SUSE Bug 1042307
- SUSE Bug 1042308
- SUSE Bug 1042309
- SUSE CVE CVE-2017-9343 page
- SUSE CVE CVE-2017-9344 page
- SUSE CVE CVE-2017-9345 page
- SUSE CVE CVE-2017-9346 page
- SUSE CVE CVE-2017-9347 page
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-msnip.c by validating an IPv4 address.
Затронутые продукты
Ссылки
- CVE-2017-9343
- SUSE Bug 1042309
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
- SUSE Bug 1077080
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed in epan/dissectors/packet-btl2cap.c by validating an interval value.
Затронутые продукты
Ссылки
- CVE-2017-9344
- SUSE Bug 1042298
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dns.c by trying to detect self-referencing pointers.
Затронутые продукты
Ссылки
- CVE-2017-9345
- SUSE Bug 1042300
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-slsk.c by making loop bounds more explicit.
Затронутые продукты
Ссылки
- CVE-2017-9346
- SUSE Bug 1042301
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.
Затронутые продукты
Ссылки
- CVE-2017-9347
- SUSE Bug 1042308
- SUSE Bug 1042324
- SUSE Bug 1042330
Описание
In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-dof.c by validating a size value.
Затронутые продукты
Ссылки
- CVE-2017-9348
- SUSE Bug 1042303
- SUSE Bug 1042324
- SUSE Bug 1042330
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value.
Затронутые продукты
Ссылки
- CVE-2017-9349
- SUSE Bug 1042305
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length.
Затронутые продукты
Ссылки
- CVE-2017-9350
- SUSE Bug 1042299
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
- SUSE Bug 1049255
- SUSE Bug 1049621
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.
Затронутые продукты
Ссылки
- CVE-2017-9351
- SUSE Bug 1042302
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by ensuring that backwards parsing cannot occur.
Затронутые продукты
Ссылки
- CVE-2017-9352
- SUSE Bug 1042304
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.
Затронутые продукты
Ссылки
- CVE-2017-9353
- SUSE Bug 1042306
- SUSE Bug 1042324
- SUSE Bug 1042330
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address.
Затронутые продукты
Ссылки
- CVE-2017-9354
- SUSE Bug 1042307
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331