Arch Linux Security Advisory ASA-201608-20
=========================================
Severity: Low
Date    : 2016-08-27
CVE-ID  : CVE-2016-6505 CVE-2016-6506 CVE-2016-6508 CVE-2016-6509 
          CVE-2016-6510 CVE-2016-6511 CVE-2016-6512 CVE-2016-6513
Package : wireshark-cli
Type    : denial of service
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package wireshark-cli before version 2.0.5-1 is vulnerable to denial
of service.

Resolution
=========
Upgrade to 2.0.5-1.

# pacman -Syu "wireshark-cli>=2.0.5-1"

The problem has been fixed upstream in version 2.0.5.

Workaround
=========
None.

Description
==========
- CVE-2016-6505 (denial of service)

It may be possible to make Wireshark crash by injecting a malformed
packet onto the wire or by convincing someone to read a malformed packet
trace file.

- CVE-2016-6506 (denial of service)

It may be possible to make Wireshark consume excessive CPU resources by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.

- CVE-2016-6508 (denial of service)

It may be possible to make Wireshark consume excessive CPU resources by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.

- CVE-2016-6509 (denial of service)

It may be possible to make Wireshark crash by injecting a malformed
packet onto the wire or by convincing someone to read a malformed packet
trace file.

- CVE-2016-6510 (denial of service)

It may be possible to make Wireshark crash by injecting a malformed
packet onto the wire or by convincing someone to read a malformed packet
trace file.

- CVE-2016-6511 (denial of service)

It may be possible to make Wireshark consume excessive CPU resources by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.

- CVE-2016-6512 (denial of service)

It may be possible to make Wireshark crash by injecting a malformed
packet onto the wire or by convincing someone to read a malformed packet
trace file.

- CVE-2016-6513 (denial of service)

It may be possible to make Wireshark crash by injecting a malformed
packet onto the wire or by convincing someone to read a malformed packet
trace file.

Impact
=====
A remote attacker is able to crash or make wireshark consume excessive
CPU resources by injecting a malformed packet or convincing someone to
read a malformed packet trace.

References
=========
https://access.redhat.com/security/cve/CVE-2016-6505
https://access.redhat.com/security/cve/CVE-2016-6506
https://access.redhat.com/security/cve/CVE-2016-6508
https://access.redhat.com/security/cve/CVE-2016-6509
https://access.redhat.com/security/cve/CVE-2016-6510
https://access.redhat.com/security/cve/CVE-2016-6511
https://access.redhat.com/security/cve/CVE-2016-6512
https://access.redhat.com/security/cve/CVE-2016-6513
https://www.wireshark.org/security/wnpa-sec-2016-41.html
https://gitlab.com/wireshark/wireshark/-/issues/12577
;a=commit;h=94e97e45cf614c7bb8fe90c23df52910246b2c95
https://www.wireshark.org/security/wnpa-sec-2016-42.html
https://gitlab.com/wireshark/wireshark/-/issues/12594
;a=commit;h=a9d5256890c9189c7461bfce6ed6edce5d861499
https://www.wireshark.org/security/wnpa-sec-2016-44.html
https://gitlab.com/wireshark/wireshark/-/issues/12660
;a=commit;h=6cf9616df68a4db7e436bb77392586ff9ad84feb
https://www.wireshark.org/security/wnpa-sec-2016-45.html
https://gitlab.com/wireshark/wireshark/-/issues/12662
;a=commit;h=5a469ddc893f7c1912d0e15cc73bd3011e6cc2fb
https://www.wireshark.org/security/wnpa-sec-2016-46.html
https://gitlab.com/wireshark/wireshark/-/issues/12664
;a=commit;h=47a5fa850b388fcf4ea762073806f01b459820fe
https://www.wireshark.org/security/wnpa-sec-2016-47.html
https://gitlab.com/wireshark/wireshark/-/issues/12659
;a=commit;h=56706427f53cc64793870bf072c2c06248ae88f3
https://www.wireshark.org/security/wnpa-sec-2016-48.html
https://gitlab.com/wireshark/wireshark/-/issues/12661
;a=commit;h=2193bea3212d74e2a907152055e27d409b59485e
https://www.wireshark.org/security/wnpa-sec-2016-49.html
https://gitlab.com/wireshark/wireshark/-/issues/12663
;a=commit;h=347f071f1b9180563c28b0f3d0627b91eb456c72

ArchLinux: 201608-20: wireshark-cli: denial of service

August 27, 2016

Summary

- CVE-2016-6505 (denial of service) It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
- CVE-2016-6506 (denial of service)
It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
- CVE-2016-6508 (denial of service)
It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
- CVE-2016-6509 (denial of service)
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
- CVE-2016-6510 (denial of service)
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
- CVE-2016-6511 (denial of service)
It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
- CVE-2016-6512 (denial of service)
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.
- CVE-2016-6513 (denial of service)
It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Resolution

Upgrade to 2.0.5-1. # pacman -Syu "wireshark-cli>=2.0.5-1"
The problem has been fixed upstream in version 2.0.5.

References

https://access.redhat.com/security/cve/CVE-2016-6505 https://access.redhat.com/security/cve/CVE-2016-6506 https://access.redhat.com/security/cve/CVE-2016-6508 https://access.redhat.com/security/cve/CVE-2016-6509 https://access.redhat.com/security/cve/CVE-2016-6510 https://access.redhat.com/security/cve/CVE-2016-6511 https://access.redhat.com/security/cve/CVE-2016-6512 https://access.redhat.com/security/cve/CVE-2016-6513 https://www.wireshark.org/security/wnpa-sec-2016-41.html https://gitlab.com/wireshark/wireshark/-/issues/12577 ;a=commit;h=94e97e45cf614c7bb8fe90c23df52910246b2c95 https://www.wireshark.org/security/wnpa-sec-2016-42.html https://gitlab.com/wireshark/wireshark/-/issues/12594 ;a=commit;h=a9d5256890c9189c7461bfce6ed6edce5d861499 https://www.wireshark.org/security/wnpa-sec-2016-44.html https://gitlab.com/wireshark/wireshark/-/issues/12660 ;a=commit;h=6cf9616df68a4db7e436bb77392586ff9ad84feb https://www.wireshark.org/security/wnpa-sec-2016-45.html https://gitlab.com/wireshark/wireshark/-/issues/12662 ;a=commit;h=5a469ddc893f7c1912d0e15cc73bd3011e6cc2fb https://www.wireshark.org/security/wnpa-sec-2016-46.html https://gitlab.com/wireshark/wireshark/-/issues/12664 ;a=commit;h=47a5fa850b388fcf4ea762073806f01b459820fe https://www.wireshark.org/security/wnpa-sec-2016-47.html https://gitlab.com/wireshark/wireshark/-/issues/12659 ;a=commit;h=56706427f53cc64793870bf072c2c06248ae88f3 https://www.wireshark.org/security/wnpa-sec-2016-48.html https://gitlab.com/wireshark/wireshark/-/issues/12661 ;a=commit;h=2193bea3212d74e2a907152055e27d409b59485e https://www.wireshark.org/security/wnpa-sec-2016-49.html https://gitlab.com/wireshark/wireshark/-/issues/12663 ;a=commit;h=347f071f1b9180563c28b0f3d0627b91eb456c72

Severity
CVE-2016-6510 CVE-2016-6511 CVE-2016-6512 CVE-2016-6513
Package : wireshark-cli
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/title/CVE

Workaround

None.

Related News

19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved