Bug 664852 (CVE-2018-16056, CVE-2018-16057, CVE-2018-16058)

Summary:	<net-analyzer/wireshark-2.6.3 multiple vulnerabilities
Product:	Gentoo Security	Reporter:	Jeroen Roovers (RETIRED) <jer>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	netmon
Priority:	Normal	Flags:	stable-bot: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.wireshark.org/lists/wireshark-announce/201808/msg00000.html
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=668416
Whiteboard:	B3 [noglsa cve]
Package list:	net-analyzer/wireshark-2.6.3	Runtime testing required:	---

Description Jeroen Roovers (RETIRED) gentoo-dev

2018-08-29 19:46:38 UTC

What’s New

  Bug Fixes

   The following vulnerabilities have been fixed:

     • wnpa-sec-2018-44[1] Bluetooth AVDTP dissector crash. Bug 14884[2].
       CVE-2018-16058[3].

     • wnpa-sec-2018-45[4] Bluetooth Attribute Protocol dissector crash.
       Bug 14994[5]. CVE-2018-16056[6].

     • wnpa-sec-2018-46[7] Radiotap dissector crash. Bug 15022[8].
       CVE-2018-16057[9].

Comment 1 Stabilization helper bot gentoo-dev

2018-08-29 20:00:27 UTC

An automated check of this bug failed - the following atom is unknown:

net-analyzer/wireshark-2.6.3

Please verify the atom list.

Comment 2 Stabilization helper bot gentoo-dev

2018-08-30 06:02:06 UTC

An automated check of this bug failed - repoman reported dependency errors (86 lines truncated): 

> dependency.bad net-analyzer/wireshark/wireshark-2.6.3.ebuild: DEPEND: ppc(default/linux/powerpc/ppc32/13.0) ['media-libs/bcg729']
> dependency.bad net-analyzer/wireshark/wireshark-2.6.3.ebuild: RDEPEND: ppc(default/linux/powerpc/ppc32/13.0) ['media-libs/bcg729']
> dependency.bad net-analyzer/wireshark/wireshark-2.6.3.ebuild: DEPEND: ppc(default/linux/powerpc/ppc32/13.0) ['media-libs/bcg729']

Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev

2018-09-01 17:56:50 UTC

x86 stable

Comment 4 Stabilization helper bot gentoo-dev

2018-09-01 18:04:34 UTC

An automated check of this bug failed - repoman reported dependency errors (86 lines truncated): 

> dependency.bad net-analyzer/wireshark/wireshark-2.6.3.ebuild: DEPEND: ppc(default/linux/powerpc/ppc32/13.0) ['media-libs/bcg729']
> dependency.bad net-analyzer/wireshark/wireshark-2.6.3.ebuild: RDEPEND: ppc(default/linux/powerpc/ppc32/13.0) ['media-libs/bcg729']
> dependency.bad net-analyzer/wireshark/wireshark-2.6.3.ebuild: DEPEND: ppc(default/linux/powerpc/ppc32/13.0) ['media-libs/bcg729']

Comment 5 Sergei Trofimovich (RETIRED) gentoo-dev

2018-09-01 23:44:44 UTC

ia64 stable

Comment 6 Mikle Kolyada (RETIRED) archtester

2018-09-04 18:16:32 UTC

amd64 stable

Comment 7 Sergei Trofimovich (RETIRED) gentoo-dev

2018-09-07 23:14:03 UTC

hppa stable

Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev

2018-09-07 23:21:40 UTC

ppc64 stable

Comment 9 Tobias Klausmann (RETIRED) gentoo-dev

2018-09-14 12:40:17 UTC

Stable on alpha.

Comment 10 Matt Turner gentoo-dev

2018-09-16 19:31:11 UTC

ppc keywords dropped

Comment 11 Markus Meier gentoo-dev

2018-09-19 17:41:46 UTC

arm stable, all arches done.

Comment 12 Yury German Gentoo Infrastructure

2019-03-11 06:11:43 UTC

GLSA Vote: No

Maintainer(s), please drop the vulnerable version(s).
Version: 2.4.5 : 0

Comment 13 Aaron Bauman (RETIRED) gentoo-dev

2019-03-11 06:34:57 UTC

tree is clean.