Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-6175: A heap based buffer overflow in Wireshark's NetScreen file parser may lead to a local arbitrary code execution via a crafted capture file. CVE-2023-6174: SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | wireshark-cli | 1:4.0.8-2.amzn2023.0.3 |
| Amazon Linux · 2023 | wireshark-cli-debuginfo | 1:4.0.8-2.amzn2023.0.3 |
| Amazon Linux · 2023 | wireshark-debugsource | 1:4.0.8-2.amzn2023.0.3 |
| Amazon Linux · 2023 | wireshark-devel | 1:4.0.8-2.amzn2023.0.3 |
Vulnerabilities 2
-
High 7.8
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark
NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file
-
Medium 6.3
Out-of-bounds Read in Wireshark
SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of service via packet injection or crafted capture file