An update for wireshark is now available for openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1115 Final 1.0 1.0 2023-02-24 Initial 2023-02-24 2023-02-24 openEuler SA Tool V1.0 2023-02-24 wireshark security update An update for wireshark is now available for openEuler-22.03-LTS-SP1. Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols.It has many powerful features including a rich display filter language and the ability to reassemble multiple protocol packets in order to, for example, view a complete TCP stream, save the contents of a file which was transferred over HTTP or CIFS, or play back an RTP audio stream. Security Fix(es): Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows(CVE-2022-3724) Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file(CVE-2022-4344) Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file(CVE-2022-4345) Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0413) Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0417) iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0415) Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0411) TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0412) GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0416) An update for wireshark is now available for openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High wireshark https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-3724 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-4344 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-4345 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0413 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0417 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0415 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0411 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0412 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0416 https://nvd.nist.gov/vuln/detail/CVE-2022-3724 https://nvd.nist.gov/vuln/detail/CVE-2022-4344 https://nvd.nist.gov/vuln/detail/CVE-2022-4345 https://nvd.nist.gov/vuln/detail/CVE-2023-0413 https://nvd.nist.gov/vuln/detail/CVE-2023-0417 https://nvd.nist.gov/vuln/detail/CVE-2023-0415 https://nvd.nist.gov/vuln/detail/CVE-2023-0411 https://nvd.nist.gov/vuln/detail/CVE-2023-0412 https://nvd.nist.gov/vuln/detail/CVE-2023-0416 openEuler-22.03-LTS-SP1 wireshark-debuginfo-3.6.11-1.oe2203sp1.aarch64.rpm wireshark-devel-3.6.11-1.oe2203sp1.aarch64.rpm wireshark-help-3.6.11-1.oe2203sp1.aarch64.rpm wireshark-3.6.11-1.oe2203sp1.aarch64.rpm wireshark-debugsource-3.6.11-1.oe2203sp1.aarch64.rpm wireshark-3.6.11-1.oe2203sp1.src.rpm wireshark-3.6.11-1.oe2203sp1.x86_64.rpm wireshark-debuginfo-3.6.11-1.oe2203sp1.x86_64.rpm wireshark-devel-3.6.11-1.oe2203sp1.x86_64.rpm wireshark-debugsource-3.6.11-1.oe2203sp1.x86_64.rpm wireshark-help-3.6.11-1.oe2203sp1.x86_64.rpm Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows 2023-02-24 CVE-2022-3724 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2022-4344 openEuler-22.03-LTS-SP1 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2022-4345 openEuler-22.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2023-0413 openEuler-22.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2023-0417 openEuler-22.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2023-0415 openEuler-22.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2023-0411 openEuler-22.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2023-0412 openEuler-22.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115 GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-24 CVE-2023-0416 openEuler-22.03-LTS-SP1 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-24 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1115