Debian Wireshark vulnerabilities

CVE-2008-3141 [MEDIUM] CVE-2008-3141: wireshark - Unspecified vulnerability in the RMI dissector in Wireshark (formerly Ethereal) ... Unspecified vulnerability in the RMI dissector in Wireshark (formerly Ethereal) 0.9.5 through 1.0.0 allows remote attackers to read system memory via unspecified vectors. Scope: local bookworm: resolved (fixed in 1.0.1-1) bullseye: resolved (fixed in 1.0.1-1) forky: resolved (fixed in 1.0.1-1) sid: resolved (fixed in 1.0.1-1) trixie: resolved (fixed in 1.0.1-1)

CVE-2013-6338 [MEDIUM] CVE-2013-6338: wireshark - The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP disse... The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 1.10.3-1) bullseye: resolved (fix

CVE-2013-2476 [MEDIUM] CVE-2013-2476: wireshark - The dissect_hartip function in epan/dissectors/packet-hartip.c in the HART/IP di... The dissect_hartip function in epan/dissectors/packet-hartip.c in the HART/IP dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a packet with a header that is too short. Scope: local bookworm: resolved (fixed in 1.8.6-1) bullseye: resolved (fixed in 1.8.6-1) forky: resolved (fixed in 1.8.6-1) sid: re

CVE-2013-3562 [MEDIUM] CVE-2013-3562: wireshark - Multiple integer signedness errors in the tvb_unmasked function in epan/dissecto... Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet. Scope: local bookworm: resolved (fixed in 1.8.7-1) bullseye: resolved (fixed in 1.8.7-1) forky: resolved (fix

CVE-2015-8722 [MEDIUM] CVE-2015-8722: wireshark - epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1... epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 2.0.1+g59ea380-1) bullseye: resolved (fixed in 2

CVE-2013-4077 [MEDIUM] CVE-2013-4077: wireshark - Array index error in the NBAP dissector in Wireshark 1.8.x before 1.8.8 allows r... Array index error in the NBAP dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to nbap.cnf and packet-nbap.c. Scope: local bookworm: resolved (fixed in 1.10.0-1) bullseye: resolved (fixed in 1.10.0-1) forky: resolved (fixed in 1.10.0-1) sid: resolved (fixed in 1.10.0-1)

CVE-2007-6450 [MEDIUM] CVE-2007-6450: wireshark - The RPL dissector in Wireshark (formerly Ethereal) 0.9.8 to 0.99.6 allows remote... The RPL dissector in Wireshark (formerly Ethereal) 0.9.8 to 0.99.6 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors. Scope: local bookworm: resolved (fixed in 0.99.7-1) bullseye: resolved (fixed in 0.99.7-1) forky: resolved (fixed in 0.99.7-1) sid: resolved (fixed in 0.99.7-1) trixie: resolved (fixed in 0.99.7-1)

CVE-2007-3392 [MEDIUM] CVE-2007-3392: wireshark - Wireshark before 0.99.6 allows remote attackers to cause a denial of service via... Wireshark before 0.99.6 allows remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an infinite loop. Scope: local bookworm: resolved (fixed in 0.99.6pre1-1) bullseye: resolved (fixed in 0.99.6pre1-1) forky: resolved (fixed in 0.99.6pre1-1) sid: resolved (fixed in 0.99.6pre1-1) trixie: resolved (fixed in 0.99.6pre1-1)

CVE-2008-3139 [MEDIUM] CVE-2008-3139: wireshark - The RTMPT dissector in Wireshark (formerly Ethereal) 0.99.8 through 1.0.0 allows... The RTMPT dissector in Wireshark (formerly Ethereal) 0.99.8 through 1.0.0 allows remote attackers to cause a denial of service (crash) via unknown vectors. NOTE: this might be due to a use-after-free error. Scope: local bookworm: resolved (fixed in 1.0.1-1) bullseye: resolved (fixed in 1.0.1-1) forky: resolved (fixed in 1.0.1-1) sid: resolved (fixed in 1.0.1-1) tr

CVE-2007-6116 [MEDIUM] CVE-2007-6116: wireshark - The Firebird/Interbase dissector in Wireshark (formerly Ethereal) 0.99.6 allows ... The Firebird/Interbase dissector in Wireshark (formerly Ethereal) 0.99.6 allows remote attackers to cause a denial of service (infinite loop or crash) via unknown vectors. Scope: local bookworm: resolved (fixed in 0.99.7~pre1-1) bullseye: resolved (fixed in 0.99.7~pre1-1) forky: resolved (fixed in 0.99.7~pre1-1) sid: resolved (fixed in 0.99.7~pre1-1) trixie: resol

CVE-2021-4183 [MEDIUM] CVE-2021-4183: wireshark - Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via ... Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file Scope: local bookworm: resolved (fixed in 3.6.2-1) bullseye: resolved forky: resolved (fixed in 3.6.2-1) sid: resolved (fixed in 3.6.2-1) trixie: resolved (fixed in 3.6.2-1)

CVE-2015-8718 [MEDIUM] CVE-2015-8718: wireshark - Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector i... Double free vulnerability in epan/dissectors/packet-nlm.c in the NLM dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1, when the "Match MSG/RES packets for async NLM" option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 2.0.1+g59ea380-1) bullseye

CVE-2015-8719 [MEDIUM] CVE-2015-8719: wireshark - The dissect_dns_answer function in epan/dissectors/packet-dns.c in the DNS disse... The dissect_dns_answer function in epan/dissectors/packet-dns.c in the DNS dissector in Wireshark 1.12.x before 1.12.9 mishandles the EDNS0 Client Subnet option, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 2.0.1+g59ea380-1) bullseye: resolved (fixed in 2.0.1+g59ea380

CVE-2015-3182 [MEDIUM] CVE-2015-3182: wireshark - epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1... epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1.10.12 through 1.10.14 mishandles a certain strdup return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 1.12.0~rc1-1) bullseye: resolved (fixed in 1.12.0~rc1-1) forky: resolved (fixe

CVE-2018-19626 [MEDIUM] CVE-2018-19626: wireshark - In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash.... In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination. Scope: local bookworm: resolved (fixed in 2.6.5-1) bullseye: resolved (fixed in 2.6.5-1) forky: resolved (fixed in 2.6.5-1) sid: resolved (fixed in 2.6.5-1) trixie: resolved (fixed in 2.6.5-1)

CVE-2015-8742 [MEDIUM] CVE-2015-8742: wireshark - The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-... The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 2.0.1+g59ea380-1) bullseye: resolved (fi

CVE-2015-8741 [MEDIUM] CVE-2015-8741: wireshark - The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in... The dissect_ppi function in epan/dissectors/packet-ppi.c in the PPI dissector in Wireshark 2.0.x before 2.0.1 does not initialize a packet-header data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in 2.0.1+g59ea380-1) bullseye: resolved (fixed in 2.0.1+g59ea380

CVE-2015-8738 [MEDIUM] CVE-2015-8738: wireshark - The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_s... The s7comm_decode_ud_cpu_szl_subfunc function in epan/dissectors/packet-s7comm_szl_ids.c in the S7COMM dissector in Wireshark 2.0.x before 2.0.1 does not validate the list count in an SZL response, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet. Scope: local bookworm: resolved (fixed in

CVE-2013-3555 [MEDIUM] CVE-2013-3555: wireshark - epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before ... epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. Scope: local bookworm: resolved (fixed in 1.8.7-1) bullseye: resolved (fixed in 1.8.7-1) forky: resolved (fixed

CVE-2017-9616 [MEDIUM] CVE-2017-9616: wireshark - In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrol... In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect_mp4_box function in epan/dissectors/file-mp4.c. Scope: local bookworm: resolved (fixed in 2.4.0-1) bullseye: resolved (fixed in 2.4.0-1) forky: resolved (fixed in 2.4.0-1) sid: resolved (fixed in 2.4.0-1) trixie: resolved (fixed in 2.4.0-1)