Bug 13581

Summary:	[CVE 21] wireshark 4.0.5 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	RESOLVED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	blocker
Priority:	Highest	CC:	e.kosachev, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	y.tumanov: secteam_verified?
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2023-0666, CVE-2023-0667, CVE-2023-0668, CVE-2023-2854, CVE-2023-2855, CVE-2023-2856, CVE-2023-2857, CVE-2023-2858, CVE-2023-2879, CVE-2023-2952, CVE-2023-3648, CVE-2023-3649,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-08-24 00:23:22 MSK

Please patch CVEs for package wireshark version 4.0.5
  
INFO (CVEs are): wireshark 4.0.5
 cves found
CVE-2023-0666
Desc: Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0666
Severity: MEDIUM
CVE-2023-0667
Desc: Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0667
Severity: CRITICAL
CVE-2023-0668
Desc: Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0668
Severity: MEDIUM
CVE-2023-2854
Desc: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2854
Severity: MEDIUM
CVE-2023-2855
Desc: Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2855
Severity: MEDIUM
CVE-2023-2856
Desc: VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2856
Severity: MEDIUM
CVE-2023-2857
Desc: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2857
Severity: MEDIUM
CVE-2023-2858
Desc: NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2858
Severity: MEDIUM
CVE-2023-2879
Desc: GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2879
Severity: HIGH
CVE-2023-2952
Desc: XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-2952
Severity: MEDIUM
CVE-2023-3648
Desc: Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-3648
Severity: MEDIUM
CVE-2023-3649
Desc: iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-3649
Severity: MEDIUM

Comment 1 Svyatoslav Matveev 2023-10-20 19:04:22 MSK

Bug 13958