Skip to content
OpenAdvisories
High ALAS2023-2023-120 9 CVEs

Important: wireshark security update (Amazon Linux 2023)

Published Mar 6, 2023 · Updated Mar 8, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0417: Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0416: GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0415: iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0414: Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file CVE-2023-0413: Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 ... NOTE: https://www.wireshark.org/security/wnpa-sec-2023-03.html NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18766 CVE-2023-0412: TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0411: Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and ... NOTE: https://www.wireshark.org/security/wnpa-sec-2023-06.html NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18711 NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18720 NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18737 CVE-2022-4345: Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2022-4344: Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 wireshark-cli 1:4.0.3-1.amzn2023.0.1
Amazon Linux · 2023 wireshark-cli-debuginfo 1:4.0.3-1.amzn2023.0.1
Amazon Linux · 2023 wireshark-debugsource 1:4.0.3-1.amzn2023.0.1
Amazon Linux · 2023 wireshark-devel 1:4.0.3-1.amzn2023.0.1

Vulnerabilities 9

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-4344.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-4345.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0411.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0412.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0413.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0414.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0415.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0416.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-0417.html