634700 – net-analyzer/wireshark: Multiple vulnerability (CVE-2017-{9616,9617,9766})

Bug 634700 - net-analyzer/wireshark: Multiple vulnerability (CVE-2017-{9616,9617,9766})

Summary: net-analyzer/wireshark: Multiple vulnerability (CVE-2017-{9616,9617,9766})

Status:	RESOLVED DUPLICATE of bug 625474

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B3 [upstream/ebuild]
Keywords:

Depends on:
Blocks:

Reported:	2017-10-19 00:23 UTC by GLSAMaker/CVETool Bot
Modified:	2017-10-19 00:27 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description GLSAMaker/CVETool Bot gentoo-dev

2017-10-19 00:23:01 UTC

CVE-2017-9766 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9766):
  In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows
  remote attackers to cause a denial of service (stack exhaustion) in the
  dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c.

CVE-2017-9617 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9617):
  In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion
  (uncontrolled recursion) in the dissect_daap_one_tag function in
  epan/dissectors/packet-daap.c in the DAAP dissector.

CVE-2017-9616 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9616):
  In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion
  (uncontrolled recursion) in the dissect_mp4_box function in
  epan/dissectors/file-mp4.c.

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-10-19 00:27:02 UTC


*** This bug has been marked as a duplicate of bug 625474 ***