From https://www.wireshark.org/docs/relnotes/wireshark-3.6.2.html: wnpa-sec-2022-01 RTMPT dissector infinite loop. Issue 17813. wnpa-sec-2022-02 Large loops in multiple dissectors. Issue 17829, Issue 17842, Issue 17847, Issue 17855, Issue 17891, Issue 17925, Issue 17926, Issue 17931, Issue 17932, Issue 17933. wnpa-sec-2022-03 PVFS dissector crash. Issue 17840. wnpa-sec-2022-04 CSN.1 dissector crash. Issue 17882. wnpa-sec-2022-05 CMS dissector crash. Issue 17935.
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1130370af81679e2eed1571942b00ca2d30736c commit f1130370af81679e2eed1571942b00ca2d30736c Author: Sam James <sam@gentoo.org> AuthorDate: 2022-02-13 21:25:26 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-02-13 21:27:06 +0000 net-analyzer/wireshark: add 3.6.2 Closes: https://bugs.gentoo.org/833294 Signed-off-by: Sam James <sam@gentoo.org> net-analyzer/wireshark/Manifest | 1 + net-analyzer/wireshark/wireshark-3.6.2.ebuild | 273 ++++++++++++++++++++++++++ net-analyzer/wireshark/wireshark-9999.ebuild | 2 +- 3 files changed, 275 insertions(+), 1 deletion(-)
CVE-2022-0583: Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0586: Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0581: Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0582: Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
CVE-2022-0585 (https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0585.json): Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file