Debian Wireshark vulnerabilities

CVE-2006-3632 [CRITICAL] CVE-2006-3632: wireshark - Buffer overflow in Wireshark (aka Ethereal) 0.8.16 to 0.99.0 allows remote attac... Buffer overflow in Wireshark (aka Ethereal) 0.8.16 to 0.99.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the NFS dissector. Scope: local bookworm: resolved (fixed in 0.99.2-1) bullseye: resolved (fixed in 0.99.2-1) forky: resolved (fixed in 0.99.2-1) sid: resolved (fixed in 0.99.2-1) trixie: resolved (fixed in 0.9

CVE-2019-10903 [HIGH] CVE-2019-10903: wireshark - In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS diss... In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check. Scope: local bookworm: resolved (fixed in 2.6.8-1) bullseye: resolved (fixed in 2.6.8-1) forky: resolved (fixed in 2.6.8-1) sid: resolved (fixed in 2.6.8-1) trixie: resolved (fi

CVE-2019-10899 [HIGH] CVE-2019-10899: wireshark - In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector co... In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read. Scope: local bookworm: resolved (fixed in 2.6.8-1) bullseye: resolved (fixed in 2.6.8-1) forky: resolved (fixed in 2.6.8-1) sid: resolved (fixed in 2.6.8-1) trixie: resolved (

CVE-2019-10901 [HIGH] CVE-2019-10901: wireshark - In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector coul... In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly. Scope: local bookworm: resolved (fixed in 2.6.8-1) bullseye: resolved (fixed in 2.6.8-1) forky: resolved (fixed in 2.6.8-1) sid: resolved (fixed in 2.6.8-1) trixie: resolved (fixed in 2.6.8-

CVE-2021-39924 [HIGH] CVE-2021-39924: wireshark - Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 ... Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file Scope: local bookworm: resolved (fixed in 3.6.0-1) bullseye: resolved (fixed in 3.4.10-0+deb11u1) forky: resolved (fixed in 3.6.0-1) sid: resolved (fixed in 3.6.0-1) trixie: resolved (fixed in 3.6.0-1)

CVE-2021-39929 [HIGH] CVE-2021-39929: wireshark - Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.... Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file Scope: local bookworm: resolved (fixed in 3.6.0-1) bullseye: resolved (fixed in 3.4.10-0+deb11u1) forky: resolved (fixed in 3.6.0-1) sid: resolved (fixed in 3.6.0-1) trixie: resolved (fixed in 3

CVE-2018-14368 [HIGH] CVE-2018-14368: wireshark - In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar pro... In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by properly handling items that are too long. Scope: local bookworm: resolved (fixed in 2.6.2-1) bullseye: resolved (fixed in 2.6.2-1) forky: resolved (fixed in 2.6.2-1) sid: resolved (fi

CVE-2019-16319 [HIGH] CVE-2019-16319: wireshark - In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go ... In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero. Scope: local bookworm: resolved (fixed in 3.0.4-1) bullseye: resolved (fixed in 3.0.4-1) forky: resolved (fixed in 3.0.4-1) sid: resolved (fixed in 3.0.4-1) trix

CVE-2021-4182 [HIGH] CVE-2021-4182: wireshark - Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows de... Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file Scope: local bookworm: resolved (fixed in 3.6.2-1) bullseye: resolved (fixed in 3.4.16-0+deb11u1) forky: resolved (fixed in 3.6.2-1) sid: resolved (fixed in 3.6.2-1) trixie: resolved (fixed in 3.6.2-1)

CVE-2017-9766 [HIGH] CVE-2017-9766: wireshark - In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote a... In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plugins/profinet/packet-dcerpc-pn-io.c. Scope: local bookworm: resolved (fixed in 2.4.0-1) bullseye: resolved (fixed in 2.4.0-1) forky: resolved (fixed in 2.4.0-1) sid: resolved (fixed in 2.4.

CVE-2017-9350 [HIGH] CVE-2017-9350: wireshark - In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could ... In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length. Scope: local bookworm: resolved (fixed in 2.2.7-1) bullseye: resolved (fixed in 2.2.7-1) forky: resolved (fixed in 2.2.7-1) sid: resolved (fixed in 2.2.7-1) trixie

CVE-2021-39921 [HIGH] CVE-2021-39921: wireshark - NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3... NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file Scope: local bookworm: resolved (fixed in 3.6.0-1) bullseye: resolved (fixed in 3.4.10-0+deb11u1) forky: resolved (fixed in 3.6.0-1) sid: resolved (fixed in 3.6.0-1) trixie: resolved (fixed in 3.6.0-1)

CVE-2018-19622 [HIGH] CVE-2018-19622: wireshark - In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go int... In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-mmse.c by preventing length overflows. Scope: local bookworm: resolved (fixed in 2.6.5-1) bullseye: resolved (fixed in 2.6.5-1) forky: resolved (fixed in 2.6.5-1) sid: resolved (fixed in 2.6.5-1) trixie: resolved (fixed i

CVE-2020-26575 [HIGH] CVE-2020-26575: wireshark - In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector co... In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero.c by correcting the implementation of offset advancement. Scope: local bookworm: resolved (fixed in 3.2.8-0.1) bullseye: resolved (fixed in 3.2.8-0.1) forky: resolved (fixed in 3.2.8-0.1) sid: resolved (fix

CVE-2020-9428 [HIGH] CVE-2020-9428: wireshark - In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissec... In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing. Scope: local bookworm: resolved (fixed in 3.2.2-1) bullseye: resolved (fixed in 3.2.2-1) forky: resolved (fixed in 3.2.2-1) sid: resolved (fixed in 3.2.2-1) trixie: resolved (fixed i

CVE-2017-6469 [HIGH] CVE-2017-6469: wireshark - In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector cras... In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring that memory is allocated for a certain data structure. Scope: local bookworm: resolved (fixed in 2.2.5+g440fd4d-2) bullseye: resolved (fixed in 2.2.5+g440fd4d-2)

CVE-2020-15466 [HIGH] CVE-2020-15466: wireshark - In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. ... In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations. Scope: local bookworm: resolved (fixed in 3.2.5-1) bullseye: resolved (fixed in 3.2.5-1) forky: resolved (fixed in 3.2.5-1) sid: resolved (fixed in 3.2.5-1) trixie: resolved (fix

CVE-2020-13164 [HIGH] CVE-2020-13164: wireshark - In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS disse... In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recursion, such as for a cycle in the directory graph on a filesystem. Scope: local bookworm: resolved (fixed in 3.2.4-1) bullseye: resolved (fixed in 3.2.4-1) forky: resolved (fixed in 3.2.4-1

CVE-2017-11406 [HIGH] CVE-2017-11406: wireshark - In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go i... In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by rejecting invalid Frame Control parameter values. Scope: local bookworm: resolved (fixed in 2.4.0-1) bullseye: resolved (fixed in 2.4.0-1) forky: resolved (fixed in 2.4.0-1) sid: resolved (fixed in 2.4.0-1) t

CVE-2017-6470 [HIGH] CVE-2017-6470: wireshark - In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop,... In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining packet lateness. Scope: local bookworm: resolved (fixed in 2.2.5+g440fd4d-2) bullseye: resolved (fixed in 2.2.5+g440fd4d-2) forky: resolved (fixed in 2.2.5+g440