From https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html: wnpa-sec-2022-01 RTMPT dissector infinite loop. Issue 17813. wnpa-sec-2022-02 Large loops in multiple dissectors. Issue 17829, Issue 17842, Issue 17847, Issue 17855, Issue 17891, Issue 17925, Issue 17926, Issue 17931, Issue 17932, Issue 17933. wnpa-sec-2022-03 PVFS dissector crash. Issue 17840. wnpa-sec-2022-04 CSN.1 dissector crash. Issue 17882. wnpa-sec-2022-05 CMS dissector crash. Issue 17935.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1130370af81679e2eed1571942b00ca2d30736c commit f1130370af81679e2eed1571942b00ca2d30736c Author: Sam James <sam@gentoo.org> AuthorDate: 2022-02-13 21:25:26 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-02-13 21:27:06 +0000 net-analyzer/wireshark: add 3.6.2 Closes: https://bugs.gentoo.org/833294 Signed-off-by: Sam James <sam@gentoo.org> net-analyzer/wireshark/Manifest | 1 + net-analyzer/wireshark/wireshark-3.6.2.ebuild | 273 ++++++++++++++++++++++++++ net-analyzer/wireshark/wireshark-9999.ebuild | 2 +- 3 files changed, 275 insertions(+), 1 deletion(-)
CVE-2022-0583: Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0586: Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0581: Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0582: Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
CVE-2022-0585 (https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0585.json): Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e3d3daeddc9c5690c9482b49626e8b4bdf20bcfa commit e3d3daeddc9c5690c9482b49626e8b4bdf20bcfa Author: Sam James <sam@gentoo.org> AuthorDate: 2022-10-08 20:43:54 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-10-08 20:43:54 +0000 net-analyzer/wireshark: drop 3.6.3, 3.6.6 Bug: https://bugs.gentoo.org/833294 Bug: https://bugs.gentoo.org/869140 Signed-off-by: Sam James <sam@gentoo.org> net-analyzer/wireshark/Manifest | 2 - net-analyzer/wireshark/wireshark-3.6.3.ebuild | 265 ------------------------- net-analyzer/wireshark/wireshark-3.6.6.ebuild | 269 -------------------------- 3 files changed, 536 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=97d0d735c5cd87bd92649af92ac9813441500ad6 commit 97d0d735c5cd87bd92649af92ac9813441500ad6 Author: Sam James <sam@gentoo.org> AuthorDate: 2022-10-08 20:46:55 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-10-08 20:46:55 +0000 net-analyzer/wireshark: drop 3.4.11 Bug: https://bugs.gentoo.org/869140 Bug: https://bugs.gentoo.org/833294 Bug: https://bugs.gentoo.org/802216 Bug: https://bugs.gentoo.org/830343 Bug: https://bugs.gentoo.org/824474 Signed-off-by: Sam James <sam@gentoo.org> net-analyzer/wireshark/Manifest | 1 - net-analyzer/wireshark/wireshark-3.4.11.ebuild | 285 ------------------------- 2 files changed, 286 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5afc42fac6b85a1784ed825e9428c75b6e2e32b0 commit 5afc42fac6b85a1784ed825e9428c75b6e2e32b0 Author: Sam James <sam@gentoo.org> AuthorDate: 2022-10-08 20:46:37 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-10-08 20:46:37 +0000 profiles/base: mask libvirt[wireshark-plugins] for older libvirt Bug: https://bugs.gentoo.org/869140 Bug: https://bugs.gentoo.org/833294 Bug: https://bugs.gentoo.org/802216 Bug: https://bugs.gentoo.org/830343 Bug: https://bugs.gentoo.org/824474 Signed-off-by: Sam James <sam@gentoo.org> profiles/base/package.use.mask | 4 ++++ 1 file changed, 4 insertions(+)
GLSA request filed
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=e0b5bad8c2504362c0e8f33550615df1018533a8 commit e0b5bad8c2504362c0e8f33550615df1018533a8 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-10-16 14:40:26 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-10-16 14:45:23 +0000 [ GLSA 202210-04 ] Wireshark: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/802216 Bug: https://bugs.gentoo.org/824474 Bug: https://bugs.gentoo.org/830343 Bug: https://bugs.gentoo.org/833294 Bug: https://bugs.gentoo.org/869140 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202210-04.xml | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+)
GLSA released, all done!
