Security update for wireshark SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3590-1 Final 1 1 2018-10-31T14:02:45Z current 2018-10-31T14:02:45Z 2018-10-31T14:02:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wireshark This update for wireshark fixes the following issues: Wireshark was updated to 2.4.10 (bsc#1111647). Following security issues were fixed: - CVE-2018-18227: MS-WSP dissector crash (wnpa-sec-2018-47) - CVE-2018-12086: OpcUA dissector crash (wnpa-sec-2018-50) Further bug fixes and updated protocol support that were done are listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.4.10.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-2548,SUSE-SLE-DESKTOP-12-SP3-2018-2548,SUSE-SLE-SAP-12-SP2-2018-2548,SUSE-SLE-SDK-12-SP3-2018-2548,SUSE-SLE-SERVER-12-2018-2548,SUSE-SLE-SERVER-12-SP1-2018-2548,SUSE-SLE-SERVER-12-SP2-2018-2548,SUSE-SLE-SERVER-12-SP2-BCL-2018-2548,SUSE-SLE-SERVER-12-SP3-2018-2548,SUSE-Storage-4-2018-2548 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183590-1/ Link for SUSE-SU-2018:3590-1 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004819.html E-Mail link for SUSE-SU-2018:3590-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1111647 SUSE Bug 1111647 https://www.suse.com/security/cve/CVE-2018-12086/ SUSE CVE CVE-2018-12086 page https://www.suse.com/security/cve/CVE-2018-18227/ SUSE CVE CVE-2018-18227 page SUSE Enterprise Storage 4 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE OpenStack Cloud 7 libwireshark9-2.4.10-48.32.1 libwiretap7-2.4.10-48.32.1 libwscodecs1-2.4.10-48.32.1 libwsutil8-2.4.10-48.32.1 wireshark-2.4.10-48.32.1 wireshark-gtk-2.4.10-48.32.1 wireshark-devel-2.4.10-48.32.1 libwireshark9-2.4.10-48.32.1 as a component of SUSE Enterprise Storage 4 libwiretap7-2.4.10-48.32.1 as a component of SUSE Enterprise Storage 4 libwscodecs1-2.4.10-48.32.1 as a component of SUSE Enterprise Storage 4 libwsutil8-2.4.10-48.32.1 as a component of SUSE Enterprise Storage 4 wireshark-2.4.10-48.32.1 as a component of SUSE Enterprise Storage 4 wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Enterprise Storage 4 libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP3 libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP3 libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP3 libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP3 wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP3 wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12 SP3 libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12-LTSS libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12-LTSS libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12-LTSS libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12-LTSS wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12-LTSS wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server 12-LTSS libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libwireshark9-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libwiretap7-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libwscodecs1-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libwsutil8-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 wireshark-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 wireshark-gtk-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 wireshark-devel-2.4.10-48.32.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libwireshark9-2.4.10-48.32.1 as a component of SUSE OpenStack Cloud 7 libwiretap7-2.4.10-48.32.1 as a component of SUSE OpenStack Cloud 7 libwscodecs1-2.4.10-48.32.1 as a component of SUSE OpenStack Cloud 7 libwsutil8-2.4.10-48.32.1 as a component of SUSE OpenStack Cloud 7 wireshark-2.4.10-48.32.1 as a component of SUSE OpenStack Cloud 7 wireshark-gtk-2.4.10-48.32.1 as a component of SUSE OpenStack Cloud 7 Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests. CVE-2018-12086 SUSE Enterprise Storage 4:libwireshark9-2.4.10-48.32.1 SUSE Enterprise Storage 4:libwiretap7-2.4.10-48.32.1 SUSE Enterprise Storage 4:libwscodecs1-2.4.10-48.32.1 SUSE Enterprise Storage 4:libwsutil8-2.4.10-48.32.1 SUSE Enterprise Storage 4:wireshark-2.4.10-48.32.1 SUSE Enterprise Storage 4:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Software Development Kit 12 SP3:wireshark-devel-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwireshark9-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwiretap7-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwscodecs1-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwsutil8-2.4.10-48.32.1 SUSE OpenStack Cloud 7:wireshark-2.4.10-48.32.1 SUSE OpenStack Cloud 7:wireshark-gtk-2.4.10-48.32.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183590-1/ https://www.suse.com/security/cve/CVE-2018-12086.html CVE-2018-12086 https://bugzilla.suse.com/1111647 SUSE Bug 1111647 In Wireshark 2.6.0 to 2.6.3 and 2.4.0 to 2.4.9, the MS-WSP protocol dissector could crash. This was addressed in epan/dissectors/packet-mswsp.c by properly handling NULL return values. CVE-2018-18227 SUSE Enterprise Storage 4:libwireshark9-2.4.10-48.32.1 SUSE Enterprise Storage 4:libwiretap7-2.4.10-48.32.1 SUSE Enterprise Storage 4:libwscodecs1-2.4.10-48.32.1 SUSE Enterprise Storage 4:libwsutil8-2.4.10-48.32.1 SUSE Enterprise Storage 4:wireshark-2.4.10-48.32.1 SUSE Enterprise Storage 4:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Desktop 12 SP3:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP1-LTSS:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12 SP3:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server 12-LTSS:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwireshark9-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwiretap7-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwscodecs1-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libwsutil8-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:wireshark-2.4.10-48.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:wireshark-gtk-2.4.10-48.32.1 SUSE Linux Enterprise Software Development Kit 12 SP3:wireshark-devel-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwireshark9-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwiretap7-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwscodecs1-2.4.10-48.32.1 SUSE OpenStack Cloud 7:libwsutil8-2.4.10-48.32.1 SUSE OpenStack Cloud 7:wireshark-2.4.10-48.32.1 SUSE OpenStack Cloud 7:wireshark-gtk-2.4.10-48.32.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183590-1/ https://www.suse.com/security/cve/CVE-2018-18227.html CVE-2018-18227 https://bugzilla.suse.com/1111647 SUSE Bug 1111647