Bug 767907 (CVE-2021-22173, CVE-2021-22174, WNPA-SEC-2021-01, WNPA-SEC-2021-02) – <net-analyzer/wireshark-3.4.3: Multiple vulnerabilities (CVE-2021-{22173,22174})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2021-01-30 00:38:05 UTC]

* CVE-2021-22173 (wnpa-sec-2021-01)

Description
The USB HID dissector could leak memory.

Impact
It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

* CVE-2021-22174 (wnpa-sec-2021-01)

Description
The USB HID dissector could crash.

Impact
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

[Comment 1 Sam James 2021-01-30 16:14:29 UTC]

arm done

[Comment 2 Sam James 2021-02-01 04:42:47 UTC]

x86 done

[Comment 3 Sam James 2021-02-01 04:43:44 UTC]

amd64 done

[Comment 4 Sam James 2021-02-13 01:31:21 UTC]

ppc64 done

[Comment 5 Sam James 2021-02-15 10:47:35 UTC]

arm64 done

all arches done

[Comment 6 Sam James 2021-03-04 05:04:51 UTC]

Cleanup: https://github.com/gentoo/gentoo/commit/ccb5fcb72b01151e5ded89f44107d6cc964330a3

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-03-25 23:25:00 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: net-analyzer/wireshark-3.4.3

[Comment 8 NATTkA bot 2021-06-02 20:08:28 UTC]

Unable to check for sanity:

> no match for package: net-analyzer/wireshark-3.4.3

[Comment 9 GLSAMaker/CVETool Bot 2021-07-09 02:56:58 UTC]

This issue was resolved and addressed in
 GLSA 202107-21 at https://security.gentoo.org/glsa/202107-21
by GLSA coordinator Sam James (sam_c).