An update for wireshark is now available for openEuler-22.03-LTS-SP1
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2023-1115
Final
1.0
1.0
2023-02-24
Initial
2023-02-24
2023-02-24
openEuler SA Tool V1.0
2023-02-24
wireshark security update
An update for wireshark is now available for openEuler-22.03-LTS-SP1.
Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols.It has many powerful features including a rich display filter language and the ability to reassemble multiple protocol packets in order to, for example, view a complete TCP stream, save the contents of a file which was transferred over HTTP or CIFS, or play back an RTP audio stream.
Security Fix(es):
Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows(CVE-2022-3724)
Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file(CVE-2022-4344)
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file(CVE-2022-4345)
Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0413)
Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0417)
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0415)
Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0411)
TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0412)
GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0416)
An update for wireshark is now available for openEuler-22.03-LTS-SP1.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
High
wireshark
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-3724
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-4344
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-4345
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0413
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0417
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0415
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0411
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0412
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0416
https://nvd.nist.gov/vuln/detail/CVE-2022-3724
https://nvd.nist.gov/vuln/detail/CVE-2022-4344
https://nvd.nist.gov/vuln/detail/CVE-2022-4345
https://nvd.nist.gov/vuln/detail/CVE-2023-0413
https://nvd.nist.gov/vuln/detail/CVE-2023-0417
https://nvd.nist.gov/vuln/detail/CVE-2023-0415
https://nvd.nist.gov/vuln/detail/CVE-2023-0411
https://nvd.nist.gov/vuln/detail/CVE-2023-0412
https://nvd.nist.gov/vuln/detail/CVE-2023-0416
openEuler-22.03-LTS-SP1
wireshark-debuginfo-3.6.11-1.oe2203sp1.aarch64.rpm
wireshark-devel-3.6.11-1.oe2203sp1.aarch64.rpm
wireshark-help-3.6.11-1.oe2203sp1.aarch64.rpm
wireshark-3.6.11-1.oe2203sp1.aarch64.rpm
wireshark-debugsource-3.6.11-1.oe2203sp1.aarch64.rpm
wireshark-3.6.11-1.oe2203sp1.src.rpm
wireshark-3.6.11-1.oe2203sp1.x86_64.rpm
wireshark-debuginfo-3.6.11-1.oe2203sp1.x86_64.rpm
wireshark-devel-3.6.11-1.oe2203sp1.x86_64.rpm
wireshark-debugsource-3.6.11-1.oe2203sp1.x86_64.rpm
wireshark-help-3.6.11-1.oe2203sp1.x86_64.rpm
Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows
2023-02-24
CVE-2022-3724
openEuler-22.03-LTS-SP1
High
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2022-4344
openEuler-22.03-LTS-SP1
Medium
4.3
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2022-4345
openEuler-22.03-LTS-SP1
Medium
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2023-0413
openEuler-22.03-LTS-SP1
Medium
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2023-0417
openEuler-22.03-LTS-SP1
Medium
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2023-0415
openEuler-22.03-LTS-SP1
Medium
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2023-0411
openEuler-22.03-LTS-SP1
Medium
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2023-0412
openEuler-22.03-LTS-SP1
Medium
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115
GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file
2023-02-24
CVE-2023-0416
openEuler-22.03-LTS-SP1
Medium
6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
wireshark security update
2023-02-24
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115