Security update for wireshark SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0090-1 Final 1 1 2018-01-15T09:54:44Z current 2018-01-15T09:54:44Z 2018-01-15T09:54:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wireshark This update for wireshark to version 2.2.12 fixes the following issues: - CVE-2018-5334: IxVeriWave file could crash (boo#1075737) - CVE-2018-5335: WCP dissector could crash (boo#1075738) - CVE-2018-5336: Multiple dissector crashes (boo#1075739) - CVE-2017-17997: MRDISC dissector could crash (boo#1074171) This release no longers enable the Linux kernel BPF JIT compiler via the net.core.bpf_jit_enable sysctl, as this would make systems more vulnerable to Spectre variant 1 CVE-2017-5753 - (boo#1075748) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.12.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-01/msg00034.html E-Mail link for openSUSE-SU-2018:0090-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 openSUSE Leap 42.3 wireshark-2.2.12-32.1 wireshark-devel-2.2.12-32.1 wireshark-ui-gtk-2.2.12-32.1 wireshark-ui-qt-2.2.12-32.1 wireshark-2.2.12-32.1 as a component of openSUSE Leap 42.2 wireshark-devel-2.2.12-32.1 as a component of openSUSE Leap 42.2 wireshark-ui-gtk-2.2.12-32.1 as a component of openSUSE Leap 42.2 wireshark-ui-qt-2.2.12-32.1 as a component of openSUSE Leap 42.2 wireshark-2.2.12-32.1 as a component of openSUSE Leap 42.3 wireshark-devel-2.2.12-32.1 as a component of openSUSE Leap 42.3 wireshark-ui-gtk-2.2.12-32.1 as a component of openSUSE Leap 42.3 wireshark-ui-qt-2.2.12-32.1 as a component of openSUSE Leap 42.3 In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343. CVE-2017-17997 openSUSE Leap 42.2:wireshark-2.2.12-32.1 openSUSE Leap 42.2:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-qt-2.2.12-32.1 openSUSE Leap 42.3:wireshark-2.2.12-32.1 openSUSE Leap 42.3:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-qt-2.2.12-32.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-01/msg00034.html https://www.suse.com/security/cve/CVE-2017-17997.html CVE-2017-17997 https://bugzilla.suse.com/1077080 SUSE Bug 1077080 In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks. CVE-2018-5334 openSUSE Leap 42.2:wireshark-2.2.12-32.1 openSUSE Leap 42.2:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-qt-2.2.12-32.1 openSUSE Leap 42.3:wireshark-2.2.12-32.1 openSUSE Leap 42.3:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-qt-2.2.12-32.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-01/msg00034.html https://www.suse.com/security/cve/CVE-2018-5334.html CVE-2018-5334 https://bugzilla.suse.com/1075737 SUSE Bug 1075737 In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length. CVE-2018-5335 openSUSE Leap 42.2:wireshark-2.2.12-32.1 openSUSE Leap 42.2:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-qt-2.2.12-32.1 openSUSE Leap 42.3:wireshark-2.2.12-32.1 openSUSE Leap 42.3:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-qt-2.2.12-32.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-01/msg00034.html https://www.suse.com/security/cve/CVE-2018-5335.html CVE-2018-5335 https://bugzilla.suse.com/1075738 SUSE Bug 1075738 In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the JSON, XML, NTP, XMPP, and GDB dissectors could crash. This was addressed in epan/tvbparse.c by limiting the recursion depth. CVE-2018-5336 openSUSE Leap 42.2:wireshark-2.2.12-32.1 openSUSE Leap 42.2:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.2:wireshark-ui-qt-2.2.12-32.1 openSUSE Leap 42.3:wireshark-2.2.12-32.1 openSUSE Leap 42.3:wireshark-devel-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-gtk-2.2.12-32.1 openSUSE Leap 42.3:wireshark-ui-qt-2.2.12-32.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-01/msg00034.html https://www.suse.com/security/cve/CVE-2018-5336.html CVE-2018-5336 https://bugzilla.suse.com/1075739 SUSE Bug 1075739