[ASA-202102-3] wireshark-cli: denial of service

Arch Linux Security Advisory ASA-202102-3 ========================================= Severity: Low Date : 2021-02-06 CVE-ID : CVE-2021-22173 CVE-2021-22174 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1510 Summary ======= The package...

OESA-2021-1030 wireshark security update

Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.\r\n\r\n Security Fixes:\r\n\r\n In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into ...

Wireshark 3.4.x < 3.4.3 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 3.4.3. It is, therefore, affected by vulnerabilities as referenced in the wireshark-3.4.3 advisory. - The USB HID dissector could leak memory. It may be possible to make Wireshark consume excessive CPU resources by injectin...

wireshark:fuzzshark_ip_proto-udp: Stack-use-after-return in sta_prop_equal_fn

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed Report: https://oss-fuzz.com/testcase?key=4975614442471424 Project: wireshark Fuzzing Engine: libFuzzer Fuzz Target: fuzzsharkipproto-udp Job Type: libfuzzerasanwireshark Platform Id: linux...

CVE-2021-22174

Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and...

CVE-2020-26418

A flaw was discovered in the Apache Kafka protocol dissector of Wireshark while decoding packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when processed, would potentially make Wireshark crash resulting in...

Wireshark 3.4.x < 3.4.2 A Vulnerability

The version of Wireshark installed on the remote Windows host is prior to 3.4.2. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.4.2 advisory. - Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted...

Wireshark 3.4.x < 3.4.2 A Vulnerability (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.4.2. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.4.2 advisory. - Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or...

wireshark:fuzzshark_ip_proto-udp: Heap-use-after-free in g_strdup

Detailed Report: https://oss-fuzz.com/testcase?key=6262875648425984 Project: wireshark Fuzzing Engine: afl Fuzz Target: fuzzsharkipproto-udp Job Type: aflasanwireshark Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x604000f52190 Crash State: gstrdup dissectortrystringne...

CVE-2020-26422

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file...

Buffer overflow

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file...

UBUNTU-CVE-2020-26422

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file...

CVE-2020-26422

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file...

CVE-2020-26422

CVE-2020-26422 – Wireshark QUIC dissector crash has concrete details in connected sources: a buffer overflow in the QUIC dissector affects Wireshark 3.4.0–3.4.1, enabling denial of service via crafted captures or packet injections. The vulnerability stems from the QUIC dissector code path and res...

CVE-2020-26422

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file...

CVE-2020-26422

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file...

CVE-2020-26422: Buffer Copy without Checking Size of Input

Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file...

PT-2020-16425

Name of the Vulnerable Software and Affected Versions Wireshark versions 3.4.0 through 3.4.1 Description The issue is a buffer overflow in the QUIC dissector, allowing for denial of service via packet injection or crafted capture file. Recommendations For Wireshark versions 3.4.0 through 3.4.1,...

kernel: The flow_dissector feature allows device tracking

A device tracking vulnerability was found in the flowdissector feature in the Linux kernel. This flaw occurs because the auto flowlabel of the UDP IPv6 packet relies on a 32-bit hashmd value as a secret, and jhash instead of siphash is used. The hashmd value remains the same starting from boot ti...

kernel: The flow_dissector feature allows device tracking

A device tracking vulnerability was found in the flowdissector feature in the Linux kernel. This flaw occurs because the auto flowlabel of the UDP IPv6 packet relies on a 32-bit hashmd value as a secret, and jhash instead of siphash is used. The hashmd value remains the same starting from boot ti...