Fedora alert FEDORA-2009-9837 (wireshark)
| From: | updates@fedoraproject.org | |
| To: | fedora-package-announce@redhat.com | |
| Subject: | [SECURITY] Fedora 11 Update: wireshark-1.2.2-1.fc11 | |
| Date: | Wed, 04 Nov 2009 12:02:56 +0000 | |
| Message-ID: | <20091104120256.6D74210F874@bastion2.fedora.phx.redhat.com> | |
| Archive‑link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-9837 2009-09-24 04:14:19 -------------------------------------------------------------------------------- Name : wireshark Product : Fedora 11 Version : 1.2.2 Release : 1.fc11 URL : http://www.wireshark.org/ Summary : Network traffic analyzer Description : Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and filtering library, contains command-line utilities, contains plugins and documentation for wireshark. A graphical user interface is packaged separately to GTK+ package. -------------------------------------------------------------------------------- Update Information: Update to Wireshark 1.2.2 fixing multiple security issues: http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html http://www.wireshark.org/security/wnpa-sec-2009-06.html * The OpcUa dissector could use excessive CPU and memory. (Bug 3986) Versions affected: 0.99.6 to 1.0.8, 1.2.0 to 1.2.1 * The GSM A RR dissector could crash. (Bug 3893) Versions affected: 1.2.0 to 1.2.1 * The TLS dissector could crash on some platforms. (Bug 4008) Versions affected: 1.2.0 to 1.2.1 http://www.wireshark.org/docs/relnotes/wireshark-1.2.1.html http://www.wireshark.org/security/wnpa-sec-2009-04.html * The AFS dissector could crash. (Bug 3564) Versions affected: 0.9.2 to 1.2.0 * The Infiniband dissector could crash on some platforms. Versions affected: 1.0.6 to 1.2.0 * The IPMI dissector could overrun a buffer. (Bug 3559) Versions affected: 1.2.0 * The Bluetooth L2CAP dissector could crash. (Bug 3572) Versions affected: 1.2.0 * The RADIUS dissector could crash. (Bug 3578) Versions affected: 1.2.0 * The MIOP dissector could crash. (Bug 3652) Versions affected: 1.2.0 * The sFlow dissector could use excessive CPU and memory. (Bug 3570) Versions affected: 1.2.0 (Issues from wnpa-sec-2009-04 does not affect users of Wireshark 1.2.1 packages from updates-testing.) -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 22 2009 Radek Vokal <rvokal@redhat.com> - 1.2.2 - upgrade to 1.2.2 - http://www.wireshark.org/docs/relnotes/wireshark-1.2.2.html * Thu Jul 23 2009 Radek Vokal <rvokal@redhat.com> - 1.2.1 - upgrade to 1.2.1 - http://www.wireshark.org/docs/relnotes/wireshark-1.2.1.html * Tue Jun 16 2009 Radek Vokal <rvokal@redhat.com> - 1.2.0 - upgrade to 1.2.0 - http://www.wireshark.org/docs/relnotes/wireshark-1.2.0.html -------------------------------------------------------------------------------- References: [ 1 ] Bug #512953 - CVE-2009-2559 Wireshark-1.2.0: DoS (crash) due array index error in IPMI dissector https://bugzilla.redhat.com/show_bug.cgi?id=512953 [ 2 ] Bug #513008 - CVE-2009-2560 Wireshark: Null-ptr dereference in the RADIUS dissector https://bugzilla.redhat.com/show_bug.cgi?id=513008 [ 3 ] Bug #513033 - CVE-2009-2561 Wireshark: Dos (excessive CPU and memory use) via large amount of tree items in the sFlow dissector https://bugzilla.redhat.com/show_bug.cgi?id=513033 [ 4 ] Bug #512987 - CVE-2009-2562 Wireshark: Integer overflow in the AFS dissector https://bugzilla.redhat.com/show_bug.cgi?id=512987 [ 5 ] Bug #512992 - CVE-2009-2563 Wireshark: Null-ptr dereference in the InfiniBand dissector https://bugzilla.redhat.com/show_bug.cgi?id=512992 [ 6 ] Bug #523987 - CVE-2009-3241 Wireshark: DoS (excessive CPU use) in OPCUA dissector https://bugzilla.redhat.com/show_bug.cgi?id=523987 [ 7 ] Bug #524001 - CVE-2009-3242 Wireshark: DoS (crash) in GSM A RR dissector https://bugzilla.redhat.com/show_bug.cgi?id=524001 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update wireshark' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann...