ArchLinux: 201901-5: wireshark-cli: multiple issues
Summary
- CVE-2019-5716 (denial of service)
An assertion failure has been found in the 6LoWPAN dissector of
Wireshark versions prior to 2.6.6, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
- CVE-2019-5717 (denial of service)
A NULL-pointer dereference has been found in the P_MUL dissector of
Wireshark versions prior to 2.6.6, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
- CVE-2019-5718 (information disclosure)
An out-of-bounds read has been found in the RTSE dissector of Wireshark
versions prior to 2.6.6, which could be triggered by injecting a
malformed packet onto the wire or by convincing someone to read a
malformed packet trace file.
- CVE-2019-5719 (denial of service)
A NULL-pointer dereference has been found in the ISAKMP dissector of
Wireshark versions prior to 2.6.6, which could be triggered by
injecting a malformed packet onto the wire or by convincing someone to
read a malformed packet trace file.
Resolution
Upgrade to 2.6.6-1.
# pacman -Syu "wireshark-cli>=2.6.6-1"
The problems have been fixed upstream in version 2.6.6.
References
https://www.wireshark.org/docs/relnotes/wireshark-2.6.6.html https://www.wireshark.org/security/wnpa-sec-2019-01 https://gitlab.com/wireshark/wireshark/-/issues/15217 https://www.wireshark.org/security/wnpa-sec-2019-02 https://gitlab.com/wireshark/wireshark/-/issues/15337 https://www.wireshark.org/security/wnpa-sec-2019-03 https://gitlab.com/wireshark/wireshark/-/issues/15373 https://www.wireshark.org/security/wnpa-sec-2019-04 https://gitlab.com/wireshark/wireshark/-/issues/15374 https://security.archlinux.org/CVE-2019-5716 https://security.archlinux.org/CVE-2019-5717 https://security.archlinux.org/CVE-2019-5718 https://security.archlinux.org/CVE-2019-5719
Workaround
None.