GLSA 201308-05: Wireshark: Multiple vulnerabilities

Severity:	high
Title:	Wireshark: Multiple vulnerabilities
Date:	08/28/2013
Bugs:	#398549, #427964, #431572, #433990, #470262, #472762, #478694
ID:	201308-05

Synopsis

Multiple vulnerabilities have been found in Wireshark, allowing remote attackers to execute arbitrary code or cause Denial of Service.

Background

Wireshark is a versatile network protocol analyzer.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
net-analyzer/wireshark	< 1.10.1	>= 1.10.1	All supported architectures

Description

Multiple vulnerabilities have been discovered in Wireshark. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Wireshark 1.10 users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-1.10.1"
    

All Wireshark 1.8 users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-1.8.9"

References

• CVE-2012-0041
• CVE-2012-0042
• CVE-2012-0043
• CVE-2012-0066
• CVE-2012-0067
• CVE-2012-0068
• CVE-2012-3548
• CVE-2012-4048
• CVE-2012-4049
• CVE-2012-4285
• CVE-2012-4286
• CVE-2012-4287
• CVE-2012-4288
• CVE-2012-4289
• CVE-2012-4290
• CVE-2012-4291
• CVE-2012-4292
• CVE-2012-4293
• CVE-2012-4294
• CVE-2012-4295
• CVE-2012-4296
• CVE-2012-4297
• CVE-2012-4298
• CVE-2013-3555
• CVE-2013-3556
• CVE-2013-3557
• CVE-2013-3558
• CVE-2013-3559
• CVE-2013-3560
• CVE-2013-3561
• CVE-2013-3562
• CVE-2013-4074
• CVE-2013-4075
• CVE-2013-4076
• CVE-2013-4077
• CVE-2013-4078
• CVE-2013-4079
• CVE-2013-4080
• CVE-2013-4081
• CVE-2013-4082
• CVE-2013-4083
• CVE-2013-4920
• CVE-2013-4921
• CVE-2013-4922
• CVE-2013-4923
• CVE-2013-4924
• CVE-2013-4925
• CVE-2013-4926
• CVE-2013-4927
• CVE-2013-4928
• CVE-2013-4929
• CVE-2013-4930
• CVE-2013-4931
• CVE-2013-4932
• CVE-2013-4933
• CVE-2013-4934
• CVE-2013-4935
• CVE-2013-4936

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201308-05.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.