Описание
Security update for wireshark
The network analysis tool wireshark was updated to version 2.0.13 to fix the following issues:
- CVE-2017-9352: Bazaar dissector infinite loop (wnpa-sec-2017-22) (bsc#1042304)
- CVE-2017-9348: DOF dissector read overflow (wnpa-sec-2017-23) (bsc#1042303)
- CVE-2017-9351: DHCP dissector read overflow (wnpa-sec-2017-24) (bsc#1042302)
- CVE-2017-9346: SoulSeek dissector infinite loop (wnpa-sec-2017-25) (bsc#1042301)
- CVE-2017-9345: DNS dissector infinite loop (wnpa-sec-2017-26) (bsc#1042300)
- CVE-2017-9349: DICOM dissector infinite loop (wnpa-sec-2017-27) (bsc#1042305)
- CVE-2017-9350: openSAFETY dissector memory exh.. (wnpa-sec-2017-28) (bsc#1042299)
- CVE-2017-9344: BT L2CAP dissector divide by zero (wnpa-sec-2017-29) (bsc#1042298)
- CVE-2017-9343: MSNIP dissector crash (wnpa-sec-2017-30) (bsc#1042309)
- CVE-2017-9347: ROS dissector crash (wnpa-sec-2017-31) (bsc#1042308)
- CVE-2017-9354: RGMP dissector crash (wnpa-sec-2017-32) (bsc#1042307)
- CVE-2017-9353: wireshark: IPv6 dissector crash (wnpa-sec-2017-33) (bsc#1042306)
Список пакетов
SUSE Linux Enterprise Server 11 SP4
SUSE Linux Enterprise Server for SAP Applications 11 SP4
SUSE Linux Enterprise Software Development Kit 11 SP4
Ссылки
- Link for SUSE-SU-2017:1664-1
- E-Mail link for SUSE-SU-2017:1664-1
- SUSE Security Ratings
- SUSE Bug 1042298
- SUSE Bug 1042299
- SUSE Bug 1042300
- SUSE Bug 1042301
- SUSE Bug 1042302
- SUSE Bug 1042303
- SUSE Bug 1042304
- SUSE Bug 1042305
- SUSE Bug 1042306
- SUSE Bug 1042307
- SUSE Bug 1042308
- SUSE Bug 1042309
- SUSE CVE CVE-2017-9343 page
- SUSE CVE CVE-2017-9344 page
- SUSE CVE CVE-2017-9345 page
- SUSE CVE CVE-2017-9346 page
- SUSE CVE CVE-2017-9347 page
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-msnip.c by validating an IPv4 address.
Затронутые продукты
Ссылки
- CVE-2017-9343
- SUSE Bug 1042309
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
- SUSE Bug 1077080
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed in epan/dissectors/packet-btl2cap.c by validating an interval value.
Затронутые продукты
Ссылки
- CVE-2017-9344
- SUSE Bug 1042298
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dns.c by trying to detect self-referencing pointers.
Затронутые продукты
Ссылки
- CVE-2017-9345
- SUSE Bug 1042300
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-slsk.c by making loop bounds more explicit.
Затронутые продукты
Ссылки
- CVE-2017-9346
- SUSE Bug 1042301
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.
Затронутые продукты
Ссылки
- CVE-2017-9347
- SUSE Bug 1042308
- SUSE Bug 1042324
- SUSE Bug 1042330
Описание
In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-dof.c by validating a size value.
Затронутые продукты
Ссылки
- CVE-2017-9348
- SUSE Bug 1042303
- SUSE Bug 1042324
- SUSE Bug 1042330
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value.
Затронутые продукты
Ссылки
- CVE-2017-9349
- SUSE Bug 1042305
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length.
Затронутые продукты
Ссылки
- CVE-2017-9350
- SUSE Bug 1042299
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
- SUSE Bug 1049255
- SUSE Bug 1049621
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.
Затронутые продукты
Ссылки
- CVE-2017-9351
- SUSE Bug 1042302
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by ensuring that backwards parsing cannot occur.
Затронутые продукты
Ссылки
- CVE-2017-9352
- SUSE Bug 1042304
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331
Описание
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.
Затронутые продукты
Ссылки
- CVE-2017-9353
- SUSE Bug 1042306
- SUSE Bug 1042324
- SUSE Bug 1042330
Описание
In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address.
Затронутые продукты
Ссылки
- CVE-2017-9354
- SUSE Bug 1042307
- SUSE Bug 1042324
- SUSE Bug 1042330
- SUSE Bug 1042331