Wireshark: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 10

• Medium 6.5
  CVE-2023-0666

  Wireshark RTPS Parsing Buffer Overflow

  Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  Jun 7, 2023
• Medium 6.5
  CVE-2023-0667

  Wireshark MSMMS parsing buffer overflow

  Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process run…

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu Azure Linux
  Jun 7, 2023
• Medium 6.5
  CVE-2023-0668

  Wireshark IEEE-C37.118 parsing buffer overflow

  Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wires…

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  Jun 7, 2023
• Medium 6.3
  CVE-2023-2879

  GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cr…

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  May 26, 2023
• Medium 5.3
  CVE-2023-2854

  BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file

  Wireshark Foundation Wireshark wireshark Debian
  May 26, 2023
• Medium 5.3
  CVE-2023-2855

  Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture f…

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  May 26, 2023
• Medium 5.3
  CVE-2023-2856

  VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted c…

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  May 26, 2023
• Medium 5.3
  CVE-2023-2857

  BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  May 26, 2023
• Medium 5.3
  CVE-2023-2858

  NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted captur…

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  May 26, 2023
• Medium 5.3
  CVE-2023-2952

  XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injecti…

  Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  May 30, 2023

Revision history

1. 2024-09-29 #13

   Neue Updates von Debian aufgenommen

2. 2024-09-09 #12

   Neue Updates von SUSE aufgenommen

3. 2023-11-14 #11

   Neue Updates von Red Hat aufgenommen

4. 2023-11-07 #10

   Neue Updates von Red Hat aufgenommen

5. 2023-09-17 #9

   Neue Updates von Gentoo aufgenommen

6. 2023-08-08 #8

   Neue Updates von Amazon aufgenommen

7. 2023-07-20 #7

   Neue Updates von Amazon aufgenommen

8. 2023-06-15 #6

   Neue Updates von Debian aufgenommen

9. 2023-06-06 #5

   Schwachstelle hinzugefügt, PoC hinzugefügt, Bewertung geändert

10. 2023-06-04 #4

    Neue Updates von Debian aufgenommen

11. 2023-05-30 #3

    Neue Updates von SUSE aufgenommen

12. 2023-05-29 #2

    CVE's ergänzt

13. 2023-05-24 #1

    Initiale Fassung

References

• Wireshark Security Advisory vom 2023-05-24
  https://www.wireshark.org/lists/wireshark-announce/202305/msg00000.html
• Wireshark Security Advisory vom 2023-05-24
  https://www.wireshark.org/lists/wireshark-announce/202305/msg00001.html
• SUSE Security Update SUSE-SU-2023:2320-1 vom 2023-05-30
  https://lists.suse.com/pipermail/sle-security-updates/2023-May/015018.html
• Debian Security Advisory DLA-3443 vom 2023-06-03
  https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html
• PoCvom 2023-05-24
  https://gitlab.com/wireshark/wireshark/-/issues/19086
• Github Advisory vom 2023-05-24
  https://github.com/advisories/GHSA-m7h5-4hfx-r2mh
• Debian Security Advisory DSA-5429 vom 2023-06-15
  https://lists.debian.org/debian-security-announce/2023/msg00120.html
• Amazon Linux Security Advisory ALAS-2023-2113 vom 2023-07-20
  https://alas.aws.amazon.com/AL2/ALAS-2023-2113.html
• Amazon Linux Security Advisory ALAS-2023-2187 vom 2023-08-09
  https://alas.aws.amazon.com/AL2/ALAS-2023-2187.html
• SUSE Security Update SUSE-SU-2023:3252-1 vom 2023-08-09
  https://lists.suse.com/pipermail/sle-security-updates/2023-August/015828.html
• Gentoo Linux Security Advisory GLSA-202309-02 vom 2023-09-17
  https://security.gentoo.org/glsa/202309-02
• Red Hat Security Advisory RHSA-2023:6469 vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6469
• Red Hat Security Advisory RHSA-2023:7015 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7015
• SUSE Security Update SUSE-SU-2024:3165-1 vom 2024-09-09
  https://lists.suse.com/pipermail/sle-security-updates/2024-September/019395.html
• Debian Security Advisory DLA-3906 vom 2024-09-30
  https://lists.debian.org/debian-lts-announce/2024/09/msg00049.html