Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4513: BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file CVE-2023-4512: CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file CVE-2023-4511: BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file CVE-2023-2906: Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | wireshark-cli | 1:4.0.8-2.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-cli-debuginfo | 1:4.0.8-2.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-debugsource | 1:4.0.8-2.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-devel | 1:4.0.8-2.amzn2023.0.1 |
Vulnerabilities 4
-
Medium 5.3
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
-
Medium 5.3
Uncontrolled Recursion in Wireshark
CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file
-
Medium 5.3
Missing Release of Memory after Effective Lifetime in Wireshark
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
-
Unscored —
Wireshark CP2179 divide by zero
Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack.