Summary: | <net-analyzer/wireshark-1.12.1: multiple vulnerabilities (CVE-2014-{6421,6422,6423,6424,6425,6426,6427,6428,6429,6430,6431,6432}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Jeroen Roovers (RETIRED) <jer> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | netmon |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | https://www.wireshark.org/docs/relnotes/wireshark-1.12.1.html | ||
Whiteboard: | B3 [glsa] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 511502 | ||
Bug Blocks: |
Description
Jeroen Roovers (RETIRED)
2014-09-16 20:34:19 UTC
Arch teams, please test and mark stable: =net-analyzer/wireshark-1.12.1 Targeted stable KEYWORDS : alpha amd64 hppa ia64 ppc ppc64 sparc x86 PPC and PPC64 will want to deal with bug #511502 too. Stable for HPPA. amd64 stable x86 stable sparc stable ppc64 stable alpha stable ia64 stable ppc stable. Maintainer(s), please cleanup. Security, please vote. CVE-2014-6432 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6432): The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not prevent data overwrites during copy operations, which allows remote attackers to cause a denial of service (application crash) via a crafted file. CVE-2014-6431 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6431): Buffer overflow in the SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers writes of uncompressed bytes beyond the end of the output buffer. CVE-2014-6430 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6430): The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. CVE-2014-6429 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6429): The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not properly handle empty input data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. CVE-2014-6428 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6428): The dissect_spdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2014-6427 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6427): Off-by-one error in the is_rtsp_request_or_reply function in epan/dissectors/packet-rtsp.c in the RTSP dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers parsing of a token located one position beyond the current position. CVE-2014-6426 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6426): The dissect_hip_tlv function in epan/dissectors/packet-hip.c in the HIP dissector in Wireshark 1.12.x before 1.12.1 does not properly handle a NULL tree, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. CVE-2014-6425 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6425): The (1) get_quoted_string and (2) get_unquoted_string functions in epan/dissectors/packet-cups.c in the CUPS dissector in Wireshark 1.12.x before 1.12.1 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a CUPS packet that lacks a trailing '\0' character. CVE-2014-6424 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6424): The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet. CVE-2014-6423 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6423): The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line. CVE-2014-6422 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6422): The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector. CVE-2014-6421 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6421): Use-after-free vulnerability in the SDP dissector in Wireshark 1.10.x before 1.10.10 allows remote attackers to cause a denial of service (application crash) via a crafted packet that leverages split memory ownership between the SDP and RTP dissectors. Arches and Maintainer(s), Thank you for your work. GLSA Vote: Yes GLSA vote: yes. glsa request filed. This issue was resolved and addressed in GLSA 201412-52 at http://security.gentoo.org/glsa/glsa-201412-52.xml by GLSA coordinator Mikle Kolyada (Zlogene). |