Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-4855: Use after free issue in editcap could cause denial of service via crafted capture file CVE-2024-4854: MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file CVE-2024-4853: Memory handling issue in editcap could cause denial of service via crafted capture file
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | wireshark-cli | 1:4.0.15-1.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-cli-debuginfo | 1:4.0.15-1.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-debugsource | 1:4.0.15-1.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-devel | 1:4.0.15-1.amzn2023.0.1 |
Vulnerabilities 3
-
Medium 6.4
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
-
Low 3.6
Mismatched Memory Management Routines in editcap
Memory handling issue in editcap could cause denial of service via crafted capture file
-
Low 3.6
Use After Free in editcap
Use after free issue in editcap could cause denial of service via crafted capture file