Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-5601: Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file CVE-2025-13946: MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service CVE-2024-4853: Memory handling issue in editcap could cause denial of service via crafted capture file CVE-2024-11596: ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | wireshark | 1:2.6.2-15.amzn2.0.10 |
| Amazon Linux · 2 | wireshark-cli | 1:2.6.2-15.amzn2.0.10 |
| Amazon Linux · 2 | wireshark-debuginfo | 1:2.6.2-15.amzn2.0.10 |
| Amazon Linux · 2 | wireshark-devel | 1:2.6.2-15.amzn2.0.10 |
Vulnerabilities 4
-
High 7.8
Buffer Over-read in Wireshark
ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file
-
High 7.8
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark
Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file
-
Medium 5.5
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service
-
Low 3.6
Mismatched Memory Management Routines in editcap
Memory handling issue in editcap could cause denial of service via crafted capture file