- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2547-1                [email protected]
https://www.debian.org/lts/security/                          Adrian Bunk
February 06, 2021                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : wireshark
Version        : 2.6.20-0+deb9u1
CVE ID         : CVE-2019-13619 CVE-2019-16319 CVE-2019-19553 CVE-2020-7045
                 CVE-2020-9428 CVE-2020-9430 CVE-2020-9431 CVE-2020-11647
                 CVE-2020-13164 CVE-2020-15466 CVE-2020-25862 CVE-2020-25863
                 CVE-2020-26418 CVE-2020-26421 CVE-2020-26575 CVE-2020-28030
Debian Bug     : 958213 974688 974689

Several vulnerabilities were fixed in Wireshark, a network sniffer.

CVE-2019-13619

    ASN.1 BER and related dissectors crash.

CVE-2019-16319

    The Gryphon dissector could go into an infinite loop.

CVE-2019-19553

    The CMS dissector could crash.

CVE-2020-7045

    The BT ATT dissector could crash.

CVE-2020-9428

    The EAP dissector could crash.

CVE-2020-9430

    The WiMax DLMAP dissector could crash.

CVE-2020-9431

    The LTE RRC dissector could leak memory.

CVE-2020-11647

    The BACapp dissector could crash.

CVE-2020-13164

    The NFS dissector could crash.

CVE-2020-15466

    The GVCP dissector could go into an infinite loop.

CVE-2020-25862

    The TCP dissector could crash.

CVE-2020-25863

    The MIME Multipart dissector could crash.

CVE-2020-26418

    Memory leak in the Kafka protocol dissector.

CVE-2020-26421

    Crash in USB HID protocol dissector.

CVE-2020-26575

    The Facebook Zero Protocol (aka FBZERO) dissector
    could enter an infinite loop.

CVE-2020-28030

    The GQUIC dissector could crash.

For Debian 9 stretch, these problems have been fixed in version
2.6.20-0+deb9u1.

We recommend that you upgrade your wireshark packages.

For the detailed security status of wireshark please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/wireshark

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS