Описание
Security update for wireshark
This update for wireshark to version 2.4.14 fixes the following issues:
Security issues fixed:
- CVE-2019-10895: NetScaler file parser crash.
- CVE-2019-10899: SRVLOC dissector crash.
- CVE-2019-10894: GSS-API dissector crash.
- CVE-2019-10896: DOF dissector crash.
- CVE-2019-10901: LDSS dissector crash.
- CVE-2019-10903: DCERPC SPOOLSS dissector crash.
- CVE-2019-9214: Avoided a dereference of a null coversation which could make RPCAP dissector crash (bsc#1127367).
- CVE-2019-9209: Fixed a buffer overflow in time values which could make ASN.1 BER and related dissectors crash (bsc#1127369).
- CVE-2019-9208: Fixed a null pointer dereference which could make TCAP dissector crash (bsc#1127370).
Non-security issue fixed:
- Update to version 2.4.14 (bsc#1131945).
This update was imported from the SUSE:SLE-12:Update update project.
Список пакетов
openSUSE Leap 42.3
Ссылки
- E-Mail link for openSUSE-SU-2019:1390-1
- SUSE Security Ratings
Описание
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called.
Затронутые продукты
Ссылки
- CVE-2019-10894
- SUSE Bug 1131941
- SUSE Bug 1131943
- SUSE Bug 1131945
Описание
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
Затронутые продукты
Ссылки
- CVE-2019-10895
- SUSE Bug 1131941
- SUSE Bug 1131943
- SUSE Bug 1131945
Описание
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
Затронутые продукты
Ссылки
- CVE-2019-10896
- SUSE Bug 1131941
- SUSE Bug 1131943
- SUSE Bug 1131945
Описание
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.
Затронутые продукты
Ссылки
- CVE-2019-10899
- SUSE Bug 1131941
- SUSE Bug 1131943
- SUSE Bug 1131945
Описание
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly.
Затронутые продукты
Ссылки
- CVE-2019-10901
- SUSE Bug 1131941
- SUSE Bug 1131943
- SUSE Bug 1131945
Описание
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check.
Затронутые продукты
Ссылки
- CVE-2019-10903
- SUSE Bug 1131941
- SUSE Bug 1131943
- SUSE Bug 1131945
Описание
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences.
Затронутые продукты
Ссылки
- CVE-2019-9208
- SUSE Bug 1127370
Описание
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values.
Затронутые продукты
Ссылки
- CVE-2019-9209
- SUSE Bug 1127369
Описание
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
Затронутые продукты
Ссылки
- CVE-2019-9214
- SUSE Bug 1127367