[ASA-201812-3] wireshark-cli: multiple issues

[Jelle van der Waa]

Arch Linux Security Advisory ASA-201812-3
=========================================

Severity: Critical
Date    : 2018-12-08
CVE-ID  : CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625
          CVE-2018-19626 CVE-2018-19627 CVE-2018-19628
Package : wireshark-cli
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-825

Summary
=======

The package wireshark-cli before version 2.6.5-1 is vulnerable to
multiple issues including arbitrary code execution, information
disclosure and denial of service.

Resolution
==========

Upgrade to 2.6.5-1.

# pacman -Syu "wireshark-cli>=2.6.5-1"

The problems have been fixed upstream in version 2.6.5.

Workaround
==========

None.

Description
===========

- CVE-2018-19622 (denial of service)

A security issue has been found in the MMSE dissector of Wireshark
versions prior to 2.6.5, which could be made to consume excessive CPU
resources by injecting a malformed packet onto the wire or by
convincing someone to read a malformed packet trace file

- CVE-2018-19623 (arbitrary code execution)

A heap-based out-of-bounds write has been found in the LBMPDM dissector
of Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file

- CVE-2018-19624 (denial of service)

A NULL-pointer dereference has been found in the PVFS dissector of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file

- CVE-2018-19625 (information disclosure)

An out-of-bounds read has been found in the dissection engine of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file

- CVE-2018-19626 (information disclosure)

An out-of-bounds read has been found in the DCOM dissector of Wireshark
versions prior to 2.6.5, which could be triggered by injecting a
malformed packet onto the wire or by convincing someone to read a
malformed packet trace file

- CVE-2018-19627 (information disclosure)

An out-of-bounds read has been found in the IxVeriWave file parser of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file

- CVE-2018-19628 (denial of service)

A divide-by-zero error has been found in the ZigBee ZCL dissector of
Wireshark versions prior to 2.6.5, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file

Impact
======

A remote attacker can execute arbitrary code, access sensitive
information or crash wireshark via a crafted network packet or a
capture file.

References
==========

https://www.wireshark.org/docs/relnotes/wireshark-2.6.5.html
https://www.wireshark.org/security/wnpa-sec-2018-54
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250
https://code.wireshark.org/review/#/c/30613/
https://www.wireshark.org/security/wnpa-sec-2018-53
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
https://code.wireshark.org/review/#/c/30346/
https://www.wireshark.org/security/wnpa-sec-2018-56
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15280
https://code.wireshark.org/review/#/c/30811/
https://www.wireshark.org/security/wnpa-sec-2018-51
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14466
https://code.wireshark.org/review/#/c/30152/
https://www.wireshark.org/security/wnpa-sec-2018-52
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15130
https://code.wireshark.org/review/#/c/30158/
https://www.wireshark.org/security/wnpa-sec-2018-55
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279
https://code.wireshark.org/review/#/c/30813/
https://www.wireshark.org/security/wnpa-sec-2018-57
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15281
https://code.wireshark.org/review/#/c/30810/
https://security.archlinux.org/CVE-2018-19622
https://security.archlinux.org/CVE-2018-19623
https://security.archlinux.org/CVE-2018-19624
https://security.archlinux.org/CVE-2018-19625
https://security.archlinux.org/CVE-2018-19626
https://security.archlinux.org/CVE-2018-19627
https://security.archlinux.org/CVE-2018-19628
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20181211/6daded10/attachment.asc>