Debian alert DLA-3906-1 (wireshark)

From:
             
 
Adrian Bunk <bunk@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3906-1] wireshark security update
Date:
             
 
Mon, 30 Sep 2024 10:39:49 +0300
Message-ID:
             
 
<ZvpVxf+UrEVTSOdH@localhost>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3906-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                          Adrian Bunk
September 30, 2024                            https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : wireshark
Version        : 3.4.16-0+deb11u1
CVE ID         : CVE-2021-4181 CVE-2021-4182 CVE-2021-4184 CVE-2021-4185 
                 CVE-2021-4186 CVE-2021-4190 CVE-2022-0581 CVE-2022-0582 
                 CVE-2022-0583 CVE-2022-0585 CVE-2022-0586 CVE-2022-3190 
                 CVE-2022-4344 CVE-2022-4345 CVE-2023-0411 CVE-2023-0412 
                 CVE-2023-0413 CVE-2023-0415 CVE-2023-0416 CVE-2023-0417 
                 CVE-2023-0666 CVE-2023-0667 CVE-2023-0668 CVE-2023-1161 
                 CVE-2023-1992 CVE-2023-1993 CVE-2023-1994 CVE-2023-2855 
                 CVE-2023-2856 CVE-2023-2858 CVE-2023-2879 CVE-2023-2906 
                 CVE-2023-2952 CVE-2023-3648 CVE-2023-3649 CVE-2023-4511 
                 CVE-2023-4512 CVE-2023-4513 CVE-2023-6175 CVE-2024-0208 
                 CVE-2024-0209 CVE-2024-0211 CVE-2024-2955 CVE-2024-4853 
                 CVE-2024-4854 CVE-2024-8250 CVE-2024-8645
Debian Bug     : 1033756 1034721 1041101 1059925 1068111 1080298

Multiple vulnerabilities have been fixed in the network traffic analyzer 
Wireshark.

CVE-2021-4181

    Sysdig Event dissector crash

CVE-2021-4182

    RFC 7468 dissector crash

CVE-2021-4184

    BitTorrent DHT dissector infinite loop

CVE-2021-4185

    RTMPT dissector infinite loop

CVE-2021-4186

    Gryphon dissector crash

CVE-2021-4190

    Kafka dissector large loop DoS

CVE-2022-0581

    CMS protocol dissector crash

CVE-2022-0582

    CSN.1 protocol dissector unaligned access

CVE-2022-0583

    PVFS protocol dissector crash

CVE-2022-0585

    Large loops in multiple dissectors

CVE-2022-0586

    RTMPT protocol dissector infinite loop

CVE-2022-3190

    F5 Ethernet Trailer dissector infinite loop

CVE-2022-4344

    Kafka protocol dissector memory exhaustion

CVE-2022-4345

    Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors

CVE-2023-0411

    Excessive loops in the BPv6, NCP and RTPS protocol dissectors

CVE-2023-0412

    TIPC dissector crash

CVE-2023-0413

    Dissection engine bug DoS

CVE-2023-0415

    iSCSI dissector crash

CVE-2023-0416

    GNW dissector crash

CVE-2023-0417

    NFS dissector memory leak

CVE-2023-0666

    RTPS parsing heap overflow

CVE-2023-0667

    MSMMS dissector buffer overflow

CVE-2023-0668

    IEEE C37.118 Synchrophasor dissector crash

CVE-2023-1161

    ISO 15765 dissector crash

CVE-2023-1992

    RPCoRDMA dissector crash

CVE-2023-1993

    LISP dissector large loop

CVE-2023-1994

    GQUIC dissector crash

CVE-2023-2855

    Candump log parser crash

CVE-2023-2856

    VMS TCPIPtrace file parser crash

CVE-2023-2858

    NetScaler file parser crash

CVE-2023-2879

    GDSDB dissector infinite loop

CVE-2023-2906

    CP2179 dissector crash

CVE-2023-2952

    XRA dissector infinite loop

CVE-2023-3648

    Kafka dissector crash

CVE-2023-3649

    iSCSI dissector crash

CVE-2023-4511

    BT SDP dissector infinite loop

CVE-2023-4512

    CBOR dissector crash

CVE-2023-4513

    BT SDP dissector memory leak

CVE-2023-6175

    NetScreen file parser crash

CVE-2024-0208

    GVCP dissector crash

CVE-2024-0209

    IEEE 1609.2 dissector crash

CVE-2024-0211

    DOCSIS dissector crash

CVE-2024-2955

    T.38 dissector crash

CVE-2024-4853

    Editcap byte chopping crash

CVE-2024-4854

    MONGO dissector infinite loop

CVE-2024-8250

    NTLMSSP dissector crash

CVE-2024-8645

    SPRT dissector crash

For Debian 11 bullseye, these problems have been fixed in version
3.4.16-0+deb11u1.

We recommend that you upgrade your wireshark packages.

For the detailed security status of wireshark please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/wireshark

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmb6VcUACgkQiNJCh6LY
mLH/dBAAnbKnPgHPIc086jce0c/s4A67r89LBFDHMoJbWA88/0zHjq6ZygqibvRJ
YZ5hX3xkjI3akFRx8muRftWNpmv5nzD/vVXm8/OLVmW2xyYhNdm7lsWZfZtWR1/l
uXG0puo3yrnGR4cnlmoYrlGmA8o3k1XQnOtDQ6jPXWlJW+nFBBPeNhcBV4Avk4xs
MQRKZtOxlAmgNvtVCs/Fd/oNqGxmyhPKvrNOpJh0bBclotapdXrwwEc42H5HoKoq
ohMDpe4f9SY7Rv62YfHJUAIRoS6vMP4xOBHgAdWxcokRtNY6r6vODN03QLEgwF1m
1R12kFb+emWOFlVbEgIHbkdXXVMapItT3SvsoQ6TcDYVG3byIJG81h/zv97ElvHC
/ukxsWdMx1ycxEVYcytqEiaIQFQmUSLfwE5+oLZqlu87VUjddtTU1EuPjlADE5eQ
iQpOsUZwGN4n4OcqVddyzRpSEb4yW/CQ7AV+YzI71rLKNA+GzvFIikzlenoqfs20
5imBd25qNaFQJ/aYaIvQ/kDMSjaYxq+PbV0r7kMU5ZK15HKfCzTyFkz9tqs1GYa/
Eam1jZFeXs04IfvnJvqkacviSL60ghDOiyMUXrsWgrtNAL8+AWG/oPqKtXeEPwjq
XisHZzr/luIjNbKH+2iy3l4So86kiu+Df+S075nHYt2+mN3YaCY=
=EMuS
-----END PGP SIGNATURE-----