Security update for wireshark

2024-07-0208:14:42

Google

osv.dev

wireshark

version 3.6.22

security update

cve-2024-4854

cve-2024-4853

cve-2024-4855

mongo

zigbee

tlv dissector

infinite loops

editcap command line utility

crash

chopping bytes

injecting secrets

writing multiple files

software

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

AI Score

7.2

Confidence

Low

This update for wireshark fixes the following issues:

Update to version 3.6.22:

CVE-2024-4854: MONGO and ZigBee TLV dissector infinite loops (bsc#1224274)
CVE-2024-4853: The editcap command line utility could crash
when chopping bytes from the beginning of a packet (bsc#1224259)
CVE-2024-4855: The editcap command line utility could crash
when injecting secrets while writing multiple files (bsc#1224276)