Security update for wireshark SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:1878-1 Final 1 1 2020-11-08T19:24:25Z current 2020-11-08T19:24:25Z 2020-11-08T19:24:25Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wireshark This update for wireshark fixes the following issues: - Update to wireshark 3.2.7: * CVE-2020-25863: MIME Multipart dissector crash (bsc#1176908) * CVE-2020-25862: TCP dissector crash (bsc#1176909) * CVE-2020-25866: BLIP dissector crash (bsc#1176910) * CVE-2020-17498: Kafka dissector crash (bsc#1175204) This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-1878 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html E-Mail link for openSUSE-SU-2020:1878-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1175204 SUSE Bug 1175204 https://bugzilla.suse.com/1176908 SUSE Bug 1176908 https://bugzilla.suse.com/1176909 SUSE Bug 1176909 https://bugzilla.suse.com/1176910 SUSE Bug 1176910 https://www.suse.com/security/cve/CVE-2020-17498/ SUSE CVE CVE-2020-17498 page https://www.suse.com/security/cve/CVE-2020-25862/ SUSE CVE CVE-2020-25862 page https://www.suse.com/security/cve/CVE-2020-25863/ SUSE CVE CVE-2020-25863 page https://www.suse.com/security/cve/CVE-2020-25866/ SUSE CVE CVE-2020-25866 page openSUSE Leap 15.1 libwireshark13-3.2.7-lp151.2.15.1 libwiretap10-3.2.7-lp151.2.15.1 libwsutil11-3.2.7-lp151.2.15.1 wireshark-3.2.7-lp151.2.15.1 wireshark-devel-3.2.7-lp151.2.15.1 wireshark-ui-qt-3.2.7-lp151.2.15.1 libwireshark13-3.2.7-lp151.2.15.1 as a component of openSUSE Leap 15.1 libwiretap10-3.2.7-lp151.2.15.1 as a component of openSUSE Leap 15.1 libwsutil11-3.2.7-lp151.2.15.1 as a component of openSUSE Leap 15.1 wireshark-3.2.7-lp151.2.15.1 as a component of openSUSE Leap 15.1 wireshark-devel-3.2.7-lp151.2.15.1 as a component of openSUSE Leap 15.1 wireshark-ui-qt-3.2.7-lp151.2.15.1 as a component of openSUSE Leap 15.1 In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during LZ4 decompression. CVE-2020-17498 openSUSE Leap 15.1:libwireshark13-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwiretap10-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwsutil11-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-devel-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-ui-qt-3.2.7-lp151.2.15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html https://www.suse.com/security/cve/CVE-2020-17498.html CVE-2020-17498 https://bugzilla.suse.com/1175204 SUSE Bug 1175204 In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changing the handling of the invalid 0xFFFF checksum. CVE-2020-25862 openSUSE Leap 15.1:libwireshark13-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwiretap10-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwsutil11-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-devel-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-ui-qt-3.2.7-lp151.2.15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html https://www.suse.com/security/cve/CVE-2020-25862.html CVE-2020-25862 https://bugzilla.suse.com/1176909 SUSE Bug 1176909 In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multipart.c by correcting the deallocation of invalid MIME parts. CVE-2020-25863 openSUSE Leap 15.1:libwireshark13-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwiretap10-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwsutil11-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-devel-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-ui-qt-3.2.7-lp151.2.15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html https://www.suse.com/security/cve/CVE-2020-25863.html CVE-2020-25863 https://bugzilla.suse.com/1176908 SUSE Bug 1176908 In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncompressed) messages. This was addressed in epan/dissectors/packet-blip.c by allowing reasonable compression ratios and rejecting ZIP bombs. CVE-2020-25866 openSUSE Leap 15.1:libwireshark13-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwiretap10-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:libwsutil11-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-devel-3.2.7-lp151.2.15.1 openSUSE Leap 15.1:wireshark-ui-qt-3.2.7-lp151.2.15.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html https://www.suse.com/security/cve/CVE-2020-25866.html CVE-2020-25866 https://bugzilla.suse.com/1176910 SUSE Bug 1176910