Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-9781: AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file CVE-2024-8645: SPRT dissector crash in Wireshark 4.2.0 to 4.0.5 and 4.0.0 to 4.0.15 allows denial of service via packet injection or crafted capture file CVE-2024-8250: NTLMSSP dissector crash in Wireshark 4.2.0 to 4.0.6 and 4.0.0 to 4.0.16 allows denial of service via packet injection or crafted capture file CVE-2024-24479: Buffer Overflow vulnerability in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. CVE-2024-11596: ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | wireshark-cli | 1:4.4.2-1.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-cli-debuginfo | 1:4.4.2-1.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-debugsource | 1:4.4.2-1.amzn2023.0.1 |
| Amazon Linux · 2023 | wireshark-devel | 1:4.4.2-1.amzn2023.0.1 |
Vulnerabilities 5
-
High 7.8
Buffer Over-read in Wireshark
ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file
-
High 7.8
Expired Pointer Dereference in Wireshark
NTLMSSP dissector crash in Wireshark 4.2.0 to 4.0.6 and 4.0.0 to 4.0.16 allows denial of service via packet injection or crafted capture file
-
High 7.8
Improper Handling of Missing Values in Wireshark
AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file
-
High 7.5
A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str…
-
Medium 5.5
Access of Uninitialized Pointer in Wireshark
SPRT dissector crash in Wireshark 4.2.0 to 4.0.5 and 4.0.0 to 4.0.15 allows denial of service via packet injection or crafted capture file
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-11596.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-24479.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-8250.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-8645.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-9781.html