Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2019:1356-1

Опубликовано: 09 мая 2019
Источник: suse-cvrf

Описание

Security update for wireshark

This update for wireshark to version 2.4.14 fixes the following issues:

Security issues fixed:

  • CVE-2019-10895: NetScaler file parser crash.
  • CVE-2019-10899: SRVLOC dissector crash.
  • CVE-2019-10894: GSS-API dissector crash.
  • CVE-2019-10896: DOF dissector crash.
  • CVE-2019-10901: LDSS dissector crash.
  • CVE-2019-10903: DCERPC SPOOLSS dissector crash.

Non-security issue fixed:

  • Update to version 2.4.14 (bsc#1131945).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.0
libwireshark9-2.4.14-lp150.2.26.3
libwiretap7-2.4.14-lp150.2.26.3
libwscodecs1-2.4.14-lp150.2.26.3
libwsutil8-2.4.14-lp150.2.26.3
wireshark-2.4.14-lp150.2.26.3
wireshark-devel-2.4.14-lp150.2.26.3
wireshark-ui-qt-2.4.14-lp150.2.26.3

Ссылки

Описание

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called.

Затронутые продукты
openSUSE Leap 15.0:libwireshark9-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwiretap7-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwscodecs1-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwsutil8-2.4.14-lp150.2.26.3
Ссылки

Описание

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.

Затронутые продукты
openSUSE Leap 15.0:libwireshark9-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwiretap7-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwscodecs1-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwsutil8-2.4.14-lp150.2.26.3
Ссылки

Описание

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.

Затронутые продукты
openSUSE Leap 15.0:libwireshark9-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwiretap7-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwscodecs1-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwsutil8-2.4.14-lp150.2.26.3
Ссылки

Описание

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.

Затронутые продукты
openSUSE Leap 15.0:libwireshark9-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwiretap7-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwscodecs1-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwsutil8-2.4.14-lp150.2.26.3
Ссылки

Описание

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly.

Затронутые продукты
openSUSE Leap 15.0:libwireshark9-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwiretap7-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwscodecs1-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwsutil8-2.4.14-lp150.2.26.3
Ссылки

Описание

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check.

Затронутые продукты
openSUSE Leap 15.0:libwireshark9-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwiretap7-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwscodecs1-2.4.14-lp150.2.26.3
openSUSE Leap 15.0:libwsutil8-2.4.14-lp150.2.26.3
Ссылки
Уязвимость openSUSE-SU-2019:1356-1