Errata overview
Errata ID 281
Date 2018-10-17
Source package wireshark
Fixed in version 2.6.3-1~deb9u1
Description
This update addresses the following issues:
* MSNIP dissector crash (wnpa-sec-2017-30) (CVE-2017-9343)
* BT L2CAP dissector divide by zero (wnpa-sec-2017-29) (CVE-2017-9344)
* DNS dissector infinite loop (wnpa-sec-2017-26) (CVE-2017-9345)
* SoulSeek dissector infinite loop (wnpa-sec-2017-25) (CVE-2017-9346)
* ROS dissector crash (wnpa-sec-2017-31) (CVE-2017-9347)
* DOF dissector read overflow (wnpa-sec-2017-23) (CVE-2017-9348)
* DICOM dissector infinite loop (wnpa-sec-2017-27) (CVE-2017-9349)
* openSAFETY dissector memory exhaustion (wnpa-sec-2017-28) (CVE-2017-9350)
* DHCP dissector read overflow (wnpa-sec-2017-24) (CVE-2017-9351)
* Bazaar dissector infinite loop (wnpa-sec-2017-22) (CVE-2017-9352)
* IPv6 dissector crash (wnpa-sec-2017-33) (CVE-2017-9353)
* RGMP dissector crash (wnpa-sec-2017-32) (CVE-2017-9354)
* Overly deep mp4 chunks may cause stack exhaustion (CVE-2017-9616)
* Deeply nested DAAP data may cause stack exhaustion (CVE-2017-9617)
* PROFINET IO data with a high recursion depth can cause stack exhaustion
  (CVE-2017-9766)
* DOCSIS infinite loop (wnpa-sec-2017-36) (CVE-2017-11406)
* MQ dissector crash (wnpa-sec-2017-35) (CVE-2017-11407)
* WBXML dissector infinite loop (wnpa-sec-2017-13) (CVE-2017-11410)
* Modbus dissector crash (wnpa-sec-2017-40) (CVE-2017-13764)
* IrCOMM dissector buffer overrun (wnpa-sec-2017-41) (CVE-2017-13765)
* MSDP dissector infinite loop (wnpa-sec-2017-38) (CVE-2017-13767)
* DOCSIS infinite loop (CVE-2017-15189)
* DMP dissector crash (CVE-2017-15191)
* BT ATT dissector crash (CVE-2017-15192)
* MBIM dissector crash (CVE-2017-15193)
* denial of service in the File_read_line function in epan/wslua/wslua_file.c
  (CVE-2017-17935)
* Misuse of NULL pointer in MRDISC dissector (CVE-2017-17997)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-thrift.c had a large loop that was addressed by not
  proceeding with dissection after encountering an unexpected type.
  (CVE-2018-7321)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-dcm.c had an infinite loop that was addressed by
  checking for integer wraparound. (CVE-2018-7322)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-wccp.c had a large loop that was addressed by
  ensuring that a calculated length was monotonically increasing.
  (CVE-2018-7323)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-sccp.c had an infinite loop that was addressed by
  using a correct integer data type. (CVE-2018-7324)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-rpki-rtr.c had an infinite loop that was addressed
  by validating a length field. (CVE-2018-7325)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-lltd.c had an infinite loop that was addressed by
  using a correct integer data type. (CVE-2018-7326)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-s7comm.c had an infinite loop that was addressed by
  correcting off-by-one errors. (CVE-2018-7329)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-ber.c had an infinite loop that was addressed by
  validating a length. (CVE-2018-7331)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-reload.c had an infinite loop that was addressed by
  validating a length. (CVE-2018-7332)
* In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12,
  epan/dissectors/packet-rpcrdma.c had an infinite loop that was addressed by
  validating a chunk size. (CVE-2018-7333)
* FCP dissector crash in packet-fcp.c (CVE-2018-7336)
* DOCSIS dissector crash in packet-docsis.c by injecting a malformed packet
  (CVE-2018-7337)
* IPMI dissector crash in packet-ipmi-picmg.c (CVE-2018-7417)
* SIGCOMP dissector crash in packet-sigcomp.c (CVE-2018-7418)
* Pcapng file parser crash in pcapng.c (CVE-2018-7420)
* In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the DMP dissector could go
  into an infinite loop. This was addressed in epan/dissectors/packet-dmp.c
  by correctly supporting a bounded number of Security Categories for a DMP
  Security Classification. (CVE-2018-7421)
* stack overflow via crafted LWAPP Layer 3 Packet (CVE-2018-9256)
* infinite loop in the CQL dissector in epan/dissectors/packet-cql.c
  (CVE-2018-9257)
* TCP dissector could crash in epan/dissectors/packet-tcp.c (CVE-2018-9258)
* MP4 dissector crash in epan/dissectors/file-mp4.c (CVE-2018-9259)
* IEEE 802.15.4 dissector crash in epan/dissectors/packet-ieee802154.c
  (CVE-2018-9260)
* VLAN dissector crash in epan/dissectors/packet-vlan.c (CVE-2018-9262)
* Kerberos dissector crash in epan/dissectors/packet-kerberos.c
  (CVE-2018-9263)
* memory leak in epan/dissectors/packet-tn3270.c (CVE-2018-9265)
* memory leak in epan/dissectors/packet-isup.c (CVE-2018-9266)
* memory leak in epan/dissectors/packet-lapd.c (CVE-2018-9267)
* memory leak in epan/dissectors/packet-smb2.c (CVE-2018-9268)
* memory leak in epan/dissectors/packet-giop.c (CVE-2018-9269)
* memory leak in epan/oids.c (CVE-2018-9270)
* memory leak in epan/dissectors/packet-multipart.c (CVE-2018-9271)
* memory leak in epan/dissectors/packet-h223.c (CVE-2018-9272)
* DNS dissector crash in packet-dns.c (CVE-2018-11356)
* Uncontrolled Resource Consumption in epan/tvbuff.c (CVE-2018-11357)
* Out-of-bounds Read in proto.c (CVE-2018-11359)
* Heap-based Buffer Overflow in dot11decrypt.c (CVE-2018-11361)
* MMSE dissector infinite loop (wnpa-sec-2018-38) (CVE-2018-14339)
* Multiple dissectors could crash (wnpa-sec-2018-36) (CVE-2018-14340)
* DICOM dissector infinite loop (wnpa-sec-2018-39) (CVE-2018-14341)
* BGP dissector large loop (wnpa-sec-2018-34) (CVE-2018-14342)
* ASN.1 BER and related dissectors crash (wnpa-sec-2018-37) (CVE-2018-14343)
* ISMP dissector crash (wnpa-sec-2018-35) (CVE-2018-14344)
* Bazaar dissector infinite loop (wnpa-sec-2018-40) (CVE-2018-14368)
* HTTP2 dissector infinite loop (wnpa-sec-2018-41) (CVE-2018-14369)
* Bluetooth Attribute Protocol dissector crash (CVE-2018-16056)
* Radiotap dissector crash (CVE-2018-16057)
* Bluetooth AVDTP dissector crash (CVE-2018-16058)
Additional notes
CVE ID CVE-2017-9343
CVE-2017-9344
CVE-2017-9345
CVE-2017-9346
CVE-2017-9347
CVE-2017-9348
CVE-2017-9349
CVE-2017-9350
CVE-2017-9351
CVE-2017-9352
CVE-2017-9353
CVE-2017-9354
CVE-2017-9616
CVE-2017-9617
CVE-2017-9766
CVE-2017-11406
CVE-2017-11407
CVE-2017-11410
CVE-2017-13764
CVE-2017-13765
CVE-2017-13767
CVE-2017-15189
CVE-2017-15191
CVE-2017-15192
CVE-2017-15193
CVE-2017-17935
CVE-2017-17997
CVE-2018-7321
CVE-2018-7322
CVE-2018-7323
CVE-2018-7324
CVE-2018-7325
CVE-2018-7326
CVE-2018-7329
CVE-2018-7331
CVE-2018-7332
CVE-2018-7333
CVE-2018-7336
CVE-2018-7337
CVE-2018-7417
CVE-2018-7418
CVE-2018-7420
CVE-2018-7421
CVE-2018-9256
CVE-2018-9257
CVE-2018-9258
CVE-2018-9259
CVE-2018-9260
CVE-2018-9262
CVE-2018-9263
CVE-2018-9265
CVE-2018-9266
CVE-2018-9267
CVE-2018-9268
CVE-2018-9269
CVE-2018-9270
CVE-2018-9271
CVE-2018-9272
CVE-2018-11356
CVE-2018-11357
CVE-2018-11359
CVE-2018-11361
CVE-2018-14339
CVE-2018-14340
CVE-2018-14341
CVE-2018-14342
CVE-2018-14343
CVE-2018-14344
CVE-2018-14368
CVE-2018-14369
CVE-2018-16056
CVE-2018-16057
CVE-2018-16058
UCS Bug number #47992