rpm package
suse/wireshark&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1
pkg:rpm/suse/wireshark&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1
Vulnerabilities (68)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-10900 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Apr 9, 2019 | In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c by handling unknown object types safely. | |
| CVE-2019-10899 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Apr 9, 2019 | In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read. | |
| CVE-2019-10898 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Apr 9, 2019 | In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gsm_gsup.c by rejecting an invalid Information Element length. | |
| CVE-2019-10897 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Apr 9, 2019 | In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-ieee80211.c by detecting cases in which the bit offset does not advance. | |
| CVE-2019-10896 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Apr 9, 2019 | In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes. | |
| CVE-2019-10895 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Apr 9, 2019 | In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation. | |
| CVE-2019-10894 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Apr 9, 2019 | In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called. | |
| CVE-2019-9214 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Feb 28, 2019 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation. | |
| CVE-2019-9209 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Feb 28, 2019 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values. | |
| CVE-2019-9208 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Feb 28, 2019 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences. | |
| CVE-2019-5721 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Jan 8, 2019 | In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by changing the memory-management approach so that a use-after-free is avoided. | |
| CVE-2019-5719 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Jan 8, 2019 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling the case of a missing decryption data block. | |
| CVE-2019-5718 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Jan 8, 2019 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was addressed in epan/charsets.c by adding a get_t61_string length check. | |
| CVE-2019-5717 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Jan 8, 2019 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid sequence number of zero. | |
| CVE-2019-5716 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Jan 8, 2019 | In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. This was addressed in epan/dissectors/packet-6lowpan.c by avoiding use of a TVB before its creation. | |
| CVE-2018-19628 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Nov 29, 2018 | In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl-lighting.c by preventing a divide-by-zero error. | |
| CVE-2018-19627 | Hig | 7.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Nov 29, 2018 | In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by adjusting a buffer boundary. | |
| CVE-2018-19626 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Nov 29, 2018 | In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination. | |
| CVE-2018-19625 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Nov 29, 2018 | In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. This was addressed in epan/tvbuff_composite.c by preventing a heap-based buffer over-read. | |
| CVE-2018-19624 | Med | 5.5 | < 3.2.2-3.35.2 | 3.2.2-3.35.2 | Nov 29, 2018 | In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by preventing a NULL pointer dereference. |
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c by handling unknown object types safely.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gsm_gsup.c by rejecting an invalid Information Element length.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-ieee80211.c by detecting cases in which the bit offset does not advance.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preventing a buffer overflow associated with excessive digits in time values.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by changing the memory-management approach so that a use-after-free is avoided.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling the case of a missing decryption data block.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was addressed in epan/charsets.c by adding a get_t61_string length check.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid sequence number of zero.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. This was addressed in epan/dissectors/packet-6lowpan.c by avoiding use of a TVB before its creation.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl-lighting.c by preventing a divide-by-zero error.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by adjusting a buffer boundary.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. This was addressed in epan/tvbuff_composite.c by preventing a heap-based buffer over-read.
- affected < 3.2.2-3.35.2fixed 3.2.2-3.35.2
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by preventing a NULL pointer dereference.
Page 2 of 4