FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

wireshark -- multiple security issues

Affected packages
2.2.0 <= wireshark <= 2.2.9
2.4.0 <= wireshark <= 2.4.1

Details

VuXML ID 4684a426-774d-4390-aa19-b8dd481c4c94
Discovery 2017-10-10
Entry 2017-10-30

wireshark developers reports:

In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.

In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.

In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.

References

CVE Name CVE-2017-15189
CVE Name CVE-2017-15190
CVE Name CVE-2017-15191
CVE Name CVE-2017-15192
CVE Name CVE-2017-15193
URL http://www.securityfocus.com/bid/101227
URL http://www.securityfocus.com/bid/101228
URL http://www.securityfocus.com/bid/101229
URL http://www.securityfocus.com/bid/101235
URL http://www.securityfocus.com/bid/101240
URL https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049
URL https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056
URL https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068
URL https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077
URL https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080
URL https://code.wireshark.org/review/23470
URL https://code.wireshark.org/review/23537
URL https://code.wireshark.org/review/23591
URL https://code.wireshark.org/review/23635
URL https://code.wireshark.org/review/23663
URL https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6
URL https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8
URL https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e
URL https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b
URL https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0
URL https://www.wireshark.org/security/wnpa-sec-2017-42.html
URL https://www.wireshark.org/security/wnpa-sec-2017-43.html
URL https://www.wireshark.org/security/wnpa-sec-2017-44.html
URL https://www.wireshark.org/security/wnpa-sec-2017-45.html
URL https://www.wireshark.org/security/wnpa-sec-2017-46.html