Changelog: https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html The following vulnerabilities have been fixed: wnpa-sec-2016-19 The NCP dissector could crash. wnpa-sec-2016-20 TShark could crash due to a packet reassembly bug. wnpa-sec-2016-21 The IEEE 802.11 dissector could crash. wnpa-sec-2016-22 The PKTC dissector could crash. wnpa-sec-2016-23 The PKTC dissector could crash. wnpa-sec-2016-24 The IAX2 dissector could go into an infinite loop. wnpa-sec-2016-25 Wireshark and TShark could exhaust the stack. wnpa-sec-2016-26 The GSM CBCH dissector could crash. wnpa-sec-2016-27 MS-WSP dissector crash.
2.1. Bug Fixes The following vulnerabilities have been fixed: wnpa-sec-2016-19 The NCP dissector could crash. (Bug 11591) wnpa-sec-2016-20 TShark could crash due to a packet reassembly bug. (Bug 11799) wnpa-sec-2016-21 The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187) wnpa-sec-2016-22 The PKTC dissector could crash. (Bug 12206) wnpa-sec-2016-23 The PKTC dissector could crash. (Bug 12242) wnpa-sec-2016-24 The IAX2 dissector could go into an infinite loop. (Bug 12260) wnpa-sec-2016-25 Wireshark and TShark could exhaust the stack. (Bug 12268) wnpa-sec-2016-26 The GSM CBCH dissector could crash. (Bug 12278) wnpa-sec-2016-27 MS-WSP dissector crash. (Bug 12341)
Arch teams, please test and mark stable: =net-analyzer/wireshark-2.0.3 Targeted stable KEYWORDS : alpha amd64 hppa ia64 ppc ppc64 sparc x86
Stable for HPPA.
Stable for PPC64.
amd64 stable
.
Stable on alpha.
Superseded by 2.0.4 (bug #585348).
Are security@ people even reading these anymore?
(In reply to Jeroen Roovers from comment #9) > Are security@ people even reading these anymore? :( Trying to keep up.
CVE-2016-4085 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4085): Stack-based buffer overflow in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.12.x before 1.12.11 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a packet. CVE-2016-4084 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4084): Integer signedness error in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 allows remote attackers to cause a denial of service (integer overflow and application crash) via a crafted packet that triggers an unexpected array size. CVE-2016-4083 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4083): epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 does not ensure that data is available before array allocation, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2016-4082 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4082): epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses the wrong variable to index an array, which allows remote attackers to cause a denial of service (out-of-bounds access and application crash) via a crafted packet. CVE-2016-4081 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4081): epan/dissectors/packet-iax2.c in the IAX2 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. CVE-2016-4080 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4080): epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 misparses timestamp fields, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. CVE-2016-4079 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4079): epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifiers, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) via a crafted packet. CVE-2016-4078 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4078): The IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not properly restrict element lists, which allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted packet, related to epan/dissectors/packet-capwap.c and epan/dissectors/packet-ieee80211.c. CVE-2016-4077 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4077): epan/reassemble.c in TShark in Wireshark 2.0.x before 2.0.3 relies on incorrect special-case handling of truncated Tvb data structures, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet. CVE-2016-4076 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4076): epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 2.0.x before 2.0.3 does not properly initialize memory for search patterns, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVE-2016-4421 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4421): epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (deep recursion, stack consumption, and application crash) via a packet that specifies deeply nested data. CVE-2016-4420 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4420): The NFS dissector in Wireshark 2.x before 2.0.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2016-4419 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4419): epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial of service (large loop) via a crafted packet. CVE-2016-4418 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4418): epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers an empty set. CVE-2016-4417 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4417): Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers a 0xff tag value. CVE-2016-4416 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4416): epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.2 mishandles the Grouping subfield, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet. CVE-2016-4415 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4415): wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 2.x before 2.0.2 incorrectly increases a certain octet count, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted file. CVE-2016-4006 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4006): epan/proto.c in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not limit the protocol-tree depth, which allows remote attackers to cause a denial of service (stack memory consumption and application crash) via a crafted packet.
@maintainer(s), please cleanup vulnerable versions.
GLSA Vote: No.
