Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0962: SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-0961: BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-0960: HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service CVE-2026-0959: IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2025-1492: Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file CVE-2025-13946: MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service CVE-2025-13945: HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service CVE-2025-13674: BPv7 dissector crash in Wireshark 4.6.0 allows denial of service CVE-2025-13499: Kafka dissector crash in Wireshark 4.6.0 and 4.4.0 to 4.4.10 allows denial of service CVE-2025-11626: MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | wireshark-cli | 1:4.4.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | wireshark-cli-debuginfo | 1:4.4.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | wireshark-debugsource | 1:4.4.2-1.amzn2023.0.4 |
| Amazon Linux · 2023 | wireshark-devel | 1:4.4.2-1.amzn2023.0.4 |
Vulnerabilities 10
-
High 7.8
Access of Uninitialized Pointer in Wireshark
Kafka dissector crash in Wireshark 4.6.0 and 4.4.0 to 4.4.10 allows denial of service
-
High 7.8
Uncontrolled Recursion in Wireshark
Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file
-
Medium 5.5
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service
-
Medium 5.5
Access of Uninitialized Pointer in Wireshark
BPv7 dissector crash in Wireshark 4.6.0 allows denial of service
-
Medium 5.5
Improperly Controlled Sequential Memory Allocation in Wireshark
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
-
Medium 5.5
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service
-
Medium 5.5
Out-of-bounds Write in Wireshark
BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service
-
Medium 5.3
Out-of-bounds Write in Wireshark
IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service
-
Medium 5.3
Out-of-bounds Write in Wireshark
SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service
-
Medium 4.7
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-11626.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-13499.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-13674.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-13945.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-13946.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-1492.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0959.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0960.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0961.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0962.html