Bug 634700

Summary:	net-analyzer/wireshark: Multiple vulnerability (CVE-2017-{9616,9617,9766})
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	minor	CC:	netmon
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [upstream/ebuild]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2017-10-19 00:23:01 UTC

CVE-2017-9766 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9766):
  In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows
  remote attackers to cause a denial of service (stack exhaustion) in the
  dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c.

CVE-2017-9617 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9617):
  In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion
  (uncontrolled recursion) in the dissect_daap_one_tag function in
  epan/dissectors/packet-daap.c in the DAAP dissector.

CVE-2017-9616 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9616):
  In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion
  (uncontrolled recursion) in the dissect_mp4_box function in
  epan/dissectors/file-mp4.c.

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-10-19 00:27:02 UTC


*** This bug has been marked as a duplicate of bug 625474 ***