9.3 - RHSA-2014:0341

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	wireshark security update

Informations
Name	RHSA-2014:0341	First vendor Publication	2014-03-31
Vendor	RedHat	Last vendor Modification	2014-03-31
Severity (Vendor)	Moderate	Revision	01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated wireshark packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network.

Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2013-3559, CVE-2013-4083, CVE-2014-2281, CVE-2014-2299)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2012-5595, CVE-2012-5598, CVE-2012-5599, CVE-2012-5600, CVE-2012-6056, CVE-2012-6060, CVE-2012-6061, CVE-2012-6062, CVE-2013-3557, CVE-2013-4081, CVE-2013-4927, CVE-2013-4931, CVE-2013-4932, CVE-2013-4933, CVE-2013-4934, CVE-2013-4935, CVE-2013-5721, CVE-2013-7112)

All Wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

881742 - CVE-2012-5600 CVE-2012-6062 wireshark: DoS (infinite loop) in the RTCP dissector (wnpa-sec-2012-38) 881748 - CVE-2012-5599 CVE-2012-6061 wireshark: DoS (infinite loop) in the WTP dissector (wnpa-sec-2012-37) 881771 - CVE-2012-5598 CVE-2012-6060 wireshark: DoS (infinite loop) in the iSCSI dissector (wnpa-sec-2012-36) 881809 - CVE-2012-5595 CVE-2012-6056 wireshark: DoS (infinite loop) in the SCTP dissector (wnpa-sec-2012-33) 965190 - CVE-2013-3559 wireshark: DoS (crash) in the DCP ETSI dissector (wnpa-sec-2013-27, upstream #8231, #8540, #8541) 965193 - CVE-2013-3557 wireshark: DoS (crash) in the ASN.1 BER dissector (wnpa-sec-2013-25, upstream #8599) 972686 - CVE-2013-4081 wireshark: DoS (infinite loop) in the HTTP dissector (wnpa-sec-2013-39) 972688 - CVE-2013-4083 wireshark: Invalid free in the DCP ETSI dissector (wnpa-sec-2013-41) 990166 - CVE-2013-4927 wireshark: Integer signedness error in the Bluetooth SDP dissector (wnpa-sec-2013-45) 990170 - CVE-2013-4931 wireshark: DoS (infinite loop) in the GSM RR dissector (wnpa-sec-2013-49) 990172 - CVE-2013-4932 wireshark: Multiple array index errors in the GSM A Common dissector (wnpa-sec-2013-50) 990175 - CVE-2013-4933 wireshark: DoS (application crash) in the Netmon file parser (wnpa-sec-2013-51) 990178 - CVE-2013-4934 wireshark: DoS (application crash) in the Netmon file parser (wnpa-sec-2013-51) (A different flaw than CVE-2013-4933) 990179 - CVE-2013-4935 wireshark: DoS (application crash) in the ASN.1 PER dissector (wnpa-sec-2013-52) 1007197 - CVE-2013-5721 wireshark: MQ dissector crash (wnpa-sec-2013-58, upstream bug 9079) 1044508 - CVE-2013-7112 wireshark: SIP dissector could go into an infinite loop (wnpa-sec-2013-66) 1074109 - CVE-2014-2299 wireshark: buffer overflow in MPEG file parser (wnpa-sec-2014-04) 1074114 - CVE-2014-2281 wireshark: NFS dissector crash (wnpa-sec-2014-01)

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2014-0341.html

CWE : Common Weakness Enumeration

%	Id	Name
33 %	CWE-189	Numeric Errors (CWE/SANS Top 25)
33 %	CWE-20	Improper Input Validation
28 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
6 %	CWE-399	Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15253

Oval ID:	oval:org.mitre.oval:def:15253
Title:	The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field
Description:	The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted value in a packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2012-6061	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.6.x before 1.6.12, or 1.8.x before 1.8.4

Definition Id: oval:org.mitre.oval:def:15894

Oval ID:	oval:org.mitre.oval:def:15894
Title:	The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet
Description:	The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2012-6062	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.6.x before 1.6.12, or 1.8.x before 1.8.4

Definition Id: oval:org.mitre.oval:def:16038

Oval ID:	oval:org.mitre.oval:def:16038
Title:	Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4
Description:	Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2012-6060	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.6.x before 1.6.12, or 1.8.x before 1.8.4

Definition Id: oval:org.mitre.oval:def:16139

Oval ID:	oval:org.mitre.oval:def:16139
Title:	Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4
Description:	Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Duplicate TSN count.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2012-6056	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.4

Definition Id: oval:org.mitre.oval:def:16228

Oval ID:	oval:org.mitre.oval:def:16228
Title:	epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types
Description:	epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application crash) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3559	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.7

Definition Id: oval:org.mitre.oval:def:16375

Oval ID:	oval:org.mitre.oval:def:16375
Title:	The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.6.x before 1.6.16, 1.8.x before 1.8.8, and 1.10.0 does not validate a certain fragment length value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet
Description:	The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.6.x before 1.6.16, 1.8.x before 1.8.8, and 1.10.0 does not validate a certain fragment length value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4083	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.6.x before 1.6.16, or 1.8.x before 1.8.8 and 1.10.0

Definition Id: oval:org.mitre.oval:def:16521

Oval ID:	oval:org.mitre.oval:def:16521
Title:	The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable
Description:	The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-3557	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.6.x before 1.6.15, or 1.8.x before 1.8.7

Definition Id: oval:org.mitre.oval:def:16820

Oval ID:	oval:org.mitre.oval:def:16820
Title:	The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which allows remote attackers to cause a denial of service (stack consumption) via a crafted packet
Description:	The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which allows remote attackers to cause a denial of service (stack consumption) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4081	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.6.x before 1.6.16, or 1.8.x before 1.8.8

Definition Id: oval:org.mitre.oval:def:17260

Oval ID:	oval:org.mitre.oval:def:17260
Title:	Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1
Description:	Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4932	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.9, or 1.10.x before 1.10.1

Definition Id: oval:org.mitre.oval:def:17325

Oval ID:	oval:org.mitre.oval:def:17325
Title:	epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector
Description:	epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4931	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.9, or 1.10.x before 1.10.1

Definition Id: oval:org.mitre.oval:def:17412

Oval ID:	oval:org.mitre.oval:def:17412
Title:	The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory
Description:	The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4933	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.9, or 1.10.x before 1.10.1

Definition Id: oval:org.mitre.oval:def:17417

Oval ID:	oval:org.mitre.oval:def:17417
Title:	The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations
Description:	The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4935	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.9, or 1.10.x before 1.10.1

Definition Id: oval:org.mitre.oval:def:17584

Oval ID:	oval:org.mitre.oval:def:17584
Title:	The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members
Description:	The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4934	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.9, or 1.10.x before 1.10.1

Definition Id: oval:org.mitre.oval:def:17636

Oval ID:	oval:org.mitre.oval:def:17636
Title:	Integer signedness error in the get_type_length function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1
Description:	Integer signedness error in the get_type_length function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-4927	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.9, or 1.10.x before 1.10.1

Definition Id: oval:org.mitre.oval:def:18499

Oval ID:	oval:org.mitre.oval:def:18499
Title:	DSA-2709-1 wireshark - several
Description:	Multiple vulnerabilities were discovered in the dissectors for CAPWAP, GMR-1 BCCH, PPP, NBAP, RDP, HTTP, DCP ETSI and in the Ixia IxVeriWave file parser, which could result in denial of service or the execution of arbitrary code.
Family:	unix	Class:	patch
Reference(s):	DSA-2709-1 CVE-2013-4074 CVE-2013-4075 CVE-2013-4076 CVE-2013-4077 CVE-2013-4078 CVE-2013-4081 CVE-2013-4082 CVE-2013-4083	Version:	8
Platform(s):	Debian GNU/Linux 7 Debian GNU/kFreeBSD 7	Product(s):	wireshark
Definition Synopsis:
Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND wireshark DPKG is earlier than 1.8.2-5wheezy4

Definition Id: oval:org.mitre.oval:def:18518

Oval ID:	oval:org.mitre.oval:def:18518
Title:	The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop
Description:	The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-5721	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. AND Version of Wireshark is 1.8.x before 1.8.10 or 1.10.x before 1.10.2

Definition Id: oval:org.mitre.oval:def:18881

Oval ID:	oval:org.mitre.oval:def:18881
Title:	DSA-2734-1 wireshark - several
Description:	Multiple vulnerabilities were discovered in the dissectors for DVB-CI, GSM A Common and ASN.1 PER and in the Netmon file parser.
Family:	unix	Class:	patch
Reference(s):	DSA-2734-1 CVE-2013-4930 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935	Version:	8
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7	Product(s):	wireshark
Definition Synopsis:
Release section Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND wireshark DPKG is earlier than 1.2.11-6+squeeze11 AND Release section Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND wireshark DPKG is earlier than 1.8.2-5wheezy5

Definition Id: oval:org.mitre.oval:def:20338

Oval ID:	oval:org.mitre.oval:def:20338
Title:	The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Description:	The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2013-7112	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. Version of Wireshark is 1.8.x before 1.8.12 or 1.10.x before 1.10.4 Version of Wireshark is 1.8.x before 1.8.12 Wireshark version is greater than or equal to 1.8.0 AND Wireshark version is less than 1.8.12 OR Version of Wireshark is 1.10.x before 1.10.4 Wireshark version is greater than or equal to 1.10.0 AND Wireshark version is less than 1.10.4

Definition Id: oval:org.mitre.oval:def:23217

Oval ID:	oval:org.mitre.oval:def:23217
Title:	Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data
Description:	Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2014-2299	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. Version of Wireshark is 1.8.x before 1.8.13 or 1.10.x before 1.10.6 Version of Wireshark is 1.8.x before 1.8.12 Wireshark version is greater than or equal to 1.8.0 AND Wireshark version is less than 1.8.13 OR Version of Wireshark is 1.10.x before 1.10.6 Wireshark version is greater than or equal to 1.10.0 AND Wireshark version is less than 1.10.6

Definition Id: oval:org.mitre.oval:def:24035

Oval ID:	oval:org.mitre.oval:def:24035
Title:	RHSA-2014:0342: wireshark security update (Moderate)
Description:	Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.
Family:	unix	Class:	patch
Reference(s):	RHSA-2014:0342-00 CESA-2014:0342 CVE-2013-6336 CVE-2013-6337 CVE-2013-6338 CVE-2013-6339 CVE-2013-6340 CVE-2013-7112 CVE-2013-7114 CVE-2014-2281 CVE-2014-2283 CVE-2014-2299	Version:	23
Platform(s):	Red Hat Enterprise Linux 6 CentOS Linux 6	Product(s):	wireshark
Definition Synopsis:
Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages section wireshark-gnome is earlier than 0:1.8.10-7.el6_5 AND wireshark is earlier than 0:1.8.10-7.el6_5 AND wireshark-devel is earlier than 0:1.8.10-7.el6_5

Definition Id: oval:org.mitre.oval:def:24160

Oval ID:	oval:org.mitre.oval:def:24160
Title:	The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet
Description:	The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2014-2281	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Wireshark
Definition Synopsis:
Wireshark is installed on the system. Version of Wireshark is 1.8.x before 1.8.13 or 1.10.x before 1.10.6 Version of Wireshark is 1.8.x before 1.8.12 Wireshark version is greater than or equal to 1.8.0 AND Wireshark version is less than 1.8.13 OR Version of Wireshark is 1.10.x before 1.10.6 Wireshark version is greater than or equal to 1.10.0 AND Wireshark version is less than 1.10.6

Definition Id: oval:org.mitre.oval:def:24197

Oval ID:	oval:org.mitre.oval:def:24197
Title:	DSA-2871-1 wireshark - several
Description:	Multiple vulnerabilities were discovered in Wireshark.
Family:	unix	Class:	patch
Reference(s):	DSA-2871-1 CVE-2014-2281 CVE-2014-2283 CVE-2014-2299	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7	Product(s):	wireshark
Definition Synopsis:
Debian 6.0 release section Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND wireshark DPKG is earlier than 0:1.2.11-6+squeeze14 AND Debian 7.x release section Debian 7 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND wireshark DPKG is earlier than 0:1.8.2-5wheezy10

Definition Id: oval:org.mitre.oval:def:24378

Oval ID:	oval:org.mitre.oval:def:24378
Title:	RHSA-2014:0341: wireshark security update (Moderate)
Description:	Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.
Family:	unix	Class:	patch
Reference(s):	RHSA-2014:0341-01 CESA-2014:0341 CVE-2012-5595 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-6056 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-3557 CVE-2013-3559 CVE-2013-4081 CVE-2013-4083 CVE-2013-4927 CVE-2013-4931 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935 CVE-2013-5721 CVE-2013-7112 CVE-2014-2281 CVE-2014-2299	Version:	47
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	wireshark
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section wireshark-gnome is earlier than 0:1.0.15-6.el5_10 AND wireshark is earlier than 0:1.0.15-6.el5_10

Definition Id: oval:org.mitre.oval:def:24432

Oval ID:	oval:org.mitre.oval:def:24432
Title:	ELSA-2014:0341: wireshark security update (Moderate)
Description:	Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2013-3559, CVE-2013-4083, CVE-2014-2281, CVE-2014-2299) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2012-5595, CVE-2012-5598, CVE-2012-5599, CVE-2012-5600, CVE-2012-6056, CVE-2012-6060, CVE-2012-6061, CVE-2012-6062, CVE-2013-3557, CVE-2013-4081, CVE-2013-4927, CVE-2013-4931, CVE-2013-4932, CVE-2013-4933, CVE-2013-4934, CVE-2013-4935, CVE-2013-5721, CVE-2013-7112) All Wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.
Family:	unix	Class:	patch
Reference(s):	ELSA-2014:0341-01 CVE-2012-5595 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-6056 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-3557 CVE-2013-3559 CVE-2013-4081 CVE-2013-4083 CVE-2013-4927 CVE-2013-4931 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935 CVE-2013-5721 CVE-2013-7112 CVE-2014-2281 CVE-2014-2299	Version:	26
Platform(s):	Oracle Linux 5	Product(s):	wireshark
Definition Synopsis:
Oracle Linux 5.x rpm test wireshark-gnome is earlier than 0:1.0.15-6.el5_10 AND wireshark is earlier than 0:1.0.15-6.el5_10

Definition Id: oval:org.mitre.oval:def:24691

Oval ID:	oval:org.mitre.oval:def:24691
Title:	ELSA-2014:0342: wireshark security update (Moderate)
Description:	Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2014-2281, CVE-2014-2299) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2013-6336, CVE-2013-6337, CVE-2013-6338, CVE-2013-6339, CVE-2013-6340, CVE-2014-2283, CVE-2013-7112, CVE-2013-7114) All Wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect.
Family:	unix	Class:	patch
Reference(s):	ELSA-2014:0342-00 CVE-2013-6336 CVE-2013-6337 CVE-2013-6338 CVE-2013-6339 CVE-2013-6340 CVE-2013-7112 CVE-2013-7114 CVE-2014-2281 CVE-2014-2283 CVE-2014-2299	Version:	14
Platform(s):	Oracle Linux 6	Product(s):	wireshark
Definition Synopsis:
Oracle Linux 6.x rpm test wireshark-gnome is earlier than 0:1.8.10-7.el6_5 AND wireshark is earlier than 0:1.8.10-7.el6_5 AND wireshark-devel is earlier than 0:1.8.10-7.el6_5

Definition Id: oval:org.mitre.oval:def:26946

Oval ID:	oval:org.mitre.oval:def:26946
Title:	RHSA-2013:1569 -- wireshark security, bug fix, and enhancement update (Moderate)
Description:	Wireshark, previously known as Ethereal, is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2013-3559, CVE-2013-4083) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2012-2392, CVE-2012-3825, CVE-2012-4285, CVE-2012-4288, CVE-2012-4289, CVE-2012-4290, CVE-2012-4291, CVE-2012-4292, CVE-2012-5595, CVE-2012-5597, CVE-2012-5598, CVE-2012-5599, CVE-2012-5600, CVE-2012-6056, CVE-2012-6059, CVE-2012-6060, CVE-2012-6061, CVE-2012-6062, CVE-2013-3557, CVE-2013-3561, CVE-2013-4081, CVE-2013-4927, CVE-2013-4931, CVE-2013-4932, CVE-2013-4933, CVE-2013-4934, CVE-2013-4935, CVE-2013-4936, CVE-2013-5721) The wireshark packages have been upgraded to upstream version 1.8.10, which provides a number of bug fixes and enhancements over the previous versions. For more information on the bugs fixed, enhancements included, and supported protocols introduced, refer to the Wireshark Release Notes, linked to in the References. (BZ#711024) This update also fixes the following bugs: * Previously, Wireshark did not parse the RECLAIM-COMPLETE opcode when inspecting traffic generated by NFSv4.1. A patch has been provided to enable the parsing of the RECLAIM_COMPLETE opcode, and Wireshark is now able to properly dissect and handle NFSv4.1 traffic. (BZ#750712) * Prior to this update, frame arrival times in a text file were reported one hour ahead from the timestamps in the packet capture file. This resulted in various failures being reported by the dfilter-test.py test suite. To fix this bug, frame arrival timestamps have been shifted by one hour, thus fixing this bug. (BZ#832021) * The "tshark -D" command returned output to STDERR instead of STDOUT, which could break scripts that are parsing the "tshark -D" output. This bug has been fixed, and the "tshark -D" command now writes output data to a correct standard stream. (BZ#1004636) * Due to an array overrun, Wireshark could experience undefined program behavior or could unexpectedly terminate. With this update, proper array handling ensures Wireshark no longer crashes in the described scenario. (BZ#715560) * Previously, the dftest and randpkt command line utilities lacked manual pages. This update adds proper manual pages for both utilities. (BZ#659661) In addition, this update adds the following enhancements: * With this update, Wireshark is able to properly dissect and handle InfiniBand and GlusterFS traffic. (BZ#699636, BZ#858976) All Wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. All running instances of Wireshark must be restarted for the update to take effect.
Family:	unix	Class:	patch
Reference(s):	RHSA-2013:1569 CESA-2013:1569 CVE-2012-2392 CVE-2012-3825 CVE-2012-4285 CVE-2012-4288 CVE-2012-4289 CVE-2012-4290 CVE-2012-4291 CVE-2012-4292 CVE-2012-5595 CVE-2012-5597 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-6056 CVE-2012-6059 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-3557 CVE-2013-3559 CVE-2013-3561 CVE-2013-4081 CVE-2013-4083 CVE-2013-4927 CVE-2013-4931 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935 CVE-2013-4936 CVE-2013-5721	Version:	3
Platform(s):	Red Hat Enterprise Linux 6 CentOS Linux 6	Product(s):	wireshark
Definition Synopsis:
Red Hat Enterprise Linux 6 and CentOS Linux 6 release section Operation system section The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages match section wireshark is earlier than 0:1.8.10-4.el6 AND wireshark-devel is earlier than 0:1.8.10-4.el6 AND wireshark-gnome is earlier than 0:1.8.10-4.el6 AND Red Hat Enterprise Linux 6 release section The operating system installed on the system is Red Hat Enterprise Linux 6 AND wireshark-debuginfo is earlier than 0:1.8.10-4.el6

Definition Id: oval:org.mitre.oval:def:27258

Oval ID:	oval:org.mitre.oval:def:27258
Title:	ELSA-2013-1569 -- wireshark security, bug fix, and enhancement update (moderate)
Description:	[1.8.10-4.0.1.el6] - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect
Family:	unix	Class:	patch
Reference(s):	ELSA-2013-1569 CVE-2012-4285 CVE-2012-4289 CVE-2012-4290 CVE-2012-4291 CVE-2012-2392 CVE-2012-3825 CVE-2012-4288 CVE-2012-4292 CVE-2012-5595 CVE-2012-5597 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-6056 CVE-2012-6059 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-3557 CVE-2013-3559 CVE-2013-3561 CVE-2013-4081 CVE-2013-4083 CVE-2013-4927 CVE-2013-4931 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935 CVE-2013-4936 CVE-2013-5721	Version:	3
Platform(s):	Oracle Linux 6	Product(s):	wireshark
Definition Synopsis:
Oracle Linux 6.x Packages match section wireshark is earlier than 0:1.8.10-4.0.1.el6 AND wireshark-devel is earlier than 0:1.8.10-4.0.1.el6 AND wireshark-gnome is earlier than 0:1.8.10-4.0.1.el6

Definition Id: oval:org.mitre.oval:def:27327

Oval ID:	oval:org.mitre.oval:def:27327
Title:	DEPRECATED: ELSA-2014-0341 -- wireshark security update (moderate)
Description:	[1.0.15-6.0.1.el5] - Added oracle-ocfs2-network.patch - increase max packet size to 65536 (Herbert van den Bergh) [orabug 13542633] [1.0.15-6] - security patches - Resolves: CVE-2012-6056 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-3557 CVE-2013-3559 CVE-2013-4081 CVE-2013-4083 CVE-2013-4927 CVE-2013-4931 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935 CVE-2013-5721 CVE-2013-7112 CVE-2014-2281 CVE-2014-2299
Family:	unix	Class:	patch
Reference(s):	ELSA-2014-0341 CVE-2012-5595 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-6056 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-3557 CVE-2013-3559 CVE-2013-4081 CVE-2013-4083 CVE-2013-4927 CVE-2013-4931 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935 CVE-2013-5721 CVE-2013-7112 CVE-2014-2281 CVE-2014-2299	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	wireshark
Definition Synopsis:
Oracle Linux 5.x Packages match section wireshark is earlier than 0:1.0.15-6.0.1.el5_10 AND wireshark-gnome is earlier than 0:1.0.15-6.0.1.el5_10

Definition Id: oval:org.mitre.oval:def:27386

Oval ID:	oval:org.mitre.oval:def:27386
Title:	DEPRECATED: ELSA-2014-0342 -- wireshark security update (moderate)
Description:	[1.8.10-7.0.1.el6] - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect [1.8.10-7] - security patches - Resolves: CVE-2013-6337 [1.8.10-6] - security patches - Resolves: CVE-2014-2281 CVE-2014-2283 CVE-2014-2299 [1.8.10-5] - security patches - Resolves: CVE-2013-6336 CVE-2013-6338 CVE-2013-6339 CVE-2013-6340 CVE-2013-7112 CVE-2013-7114
Family:	unix	Class:	patch
Reference(s):	ELSA-2014-0342 CVE-2013-6336 CVE-2013-6337 CVE-2013-6338 CVE-2013-6339 CVE-2013-6340 CVE-2013-7112 CVE-2013-7114 CVE-2014-2281 CVE-2014-2283 CVE-2014-2299	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	wireshark
Definition Synopsis:
Oracle Linux 6.x Packages match section wireshark is earlier than 0:1.8.10-7.0.1.el6_5 AND wireshark-devel is earlier than 0:1.8.10-7.0.1.el6_5 AND wireshark-gnome is earlier than 0:1.8.10-7.0.1.el6_5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Wireshark cpe:2.3:a:wireshark:wireshark:1.8.9:::::::* cpe:2.3:a:wireshark:wireshark:1.8.8:::::::* cpe:2.3:a:wireshark:wireshark:1.8.7:::::::* cpe:2.3:a:wireshark:wireshark:1.8.6:::::::* cpe:2.3:a:wireshark:wireshark:1.8.5:::::::* cpe:2.3:a:wireshark:wireshark:1.8.4:::::::* cpe:2.3:a:wireshark:wireshark:1.8.3:::::::* cpe:2.3:a:wireshark:wireshark:1.8.2:::::::* cpe:2.3:a:wireshark:wireshark:1.8.12:::::::* cpe:2.3:a:wireshark:wireshark:1.8.11:::::::* cpe:2.3:a:wireshark:wireshark:1.8.10:::::::* cpe:2.3:a:wireshark:wireshark:1.8.1:::::::* cpe:2.3:a:wireshark:wireshark:1.8.0:::::::* cpe:2.3:a:wireshark:wireshark:1.6.9:::::::* cpe:2.3:a:wireshark:wireshark:1.6.8:::::::* cpe:2.3:a:wireshark:wireshark:1.6.7:::::::* cpe:2.3:a:wireshark:wireshark:1.6.6:::::::* cpe:2.3:a:wireshark:wireshark:1.6.5:::::::* cpe:2.3:a:wireshark:wireshark:1.6.4:::::::* cpe:2.3:a:wireshark:wireshark:1.6.3:::::::* cpe:2.3:a:wireshark:wireshark:1.6.2:::::::* cpe:2.3:a:wireshark:wireshark:1.6.15:::::::* cpe:2.3:a:wireshark:wireshark:1.6.14:::::::* cpe:2.3:a:wireshark:wireshark:1.6.13:::::::* cpe:2.3:a:wireshark:wireshark:1.6.12:::::::* cpe:2.3:a:wireshark:wireshark:1.6.11:::::::* cpe:2.3:a:wireshark:wireshark:1.6.10:::::::* cpe:2.3:a:wireshark:wireshark:1.6.1:::::::* cpe:2.3:a:wireshark:wireshark:1.6.0:::::::* cpe:2.3:a:wireshark:wireshark:1.10.5:::::::* cpe:2.3:a:wireshark:wireshark:1.10.4:::::::* cpe:2.3:a:wireshark:wireshark:1.10.3:::::::* cpe:2.3:a:wireshark:wireshark:1.10.2:::::::* cpe:2.3:a:wireshark:wireshark:1.10.1:::::::* cpe:2.3:a:wireshark:wireshark:1.10.0:::::::*	35
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:8.0:::::::* cpe:2.3:o:debian:debian_linux:7.0:::::::*	2
Os	Opensuse cpe:2.3:o:opensuse:opensuse:12.3:::::::* cpe:2.3:o:opensuse:opensuse:12.2:::::::* cpe:2.3:o:opensuse:opensuse:11.4:::::::*	3

ExploitDB Exploits

id	Description
2014-04-28	Wireshark <= 1.8.12/1.10.5 wiretap/mpeg.c Stack Buffer Overflow

OpenVAS Exploits

Date	Description
2012-12-10	Name : Wireshark Multiple Dissector Multiple Vulnerabilities - Dec12 (Mac OS X) File : nvt/gb_wireshark_mult_vuln_dec12_macosx.nasl
2012-12-10	Name : Wireshark Multiple Dissector Multiple Vulnerabilities - Dec12 (Windows) File : nvt/gb_wireshark_mult_vuln_dec12_win.nasl
2012-12-07	Name : Wireshark Multiple Dissector Multiple DoS Vulnerabilities - Dec12 (Mac OS X) File : nvt/gb_wireshark_mult_dos_vuln_dec12_macosx.nasl
2012-12-07	Name : Wireshark Multiple Dissector Multiple DoS Vulnerabilities - Dec12 (Windows) File : nvt/gb_wireshark_mult_dos_vuln_dec12_win.nasl

Information Assurance Vulnerability Management (IAVM)

Date	Description
2014-03-13	IAVM : 2014-B-0029 - Multiple Vulnerabilities in Wireshark Severity : Category I - VMSKEY : V0047365
2013-09-19	IAVM : 2013-B-0105 - Multiple Vulnerabilities in Wireshark Severity : Category I - VMSKEY : V0040375

Snort® IPS/IDS

Date	Description
2014-11-16	Wireshark MPEG dissector stack buffer overflow attempt RuleID : 31987 - Revision : 3 - Type : FILE-OTHER
2014-11-16	Wireshark MPEG dissector stack buffer overflow attempt RuleID : 31986 - Revision : 3 - Type : FILE-OTHER

Nessus® Vulnerability Scanner

Date	Description
2016-06-01	Name : The remote Debian host is missing a security update. File : debian_DLA-497.nasl - Type : ACT_GATHER_INFO
2015-05-20	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2013-0238-1.nasl - Type : ACT_GATHER_INFO
2015-05-20	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2013-1276-1.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20130924.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20130521.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20130924_2.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20131210.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20140225.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_wireshark_20140522.nasl - Type : ACT_GATHER_INFO
2014-11-28	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15868.nasl - Type : ACT_GATHER_INFO
2014-11-12	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-1569.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-330.nasl - Type : ACT_GATHER_INFO
2014-06-30	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201406-33.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-9.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-536.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-626.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-714.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-214.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-3.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-844.nasl - Type : ACT_GATHER_INFO
2014-04-08	Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-140325.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0342.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140331_wireshark_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0341.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140331_wireshark_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0342.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0341.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0342.nasl - Type : ACT_GATHER_INFO
2014-04-01	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0341.nasl - Type : ACT_GATHER_INFO
2014-03-19	Name : The remote Fedora host is missing a security update. File : fedora_2014-3696.nasl - Type : ACT_GATHER_INFO
2014-03-19	Name : The remote Fedora host is missing a security update. File : fedora_2014-3676.nasl - Type : ACT_GATHER_INFO
2014-03-11	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_13.nasl - Type : ACT_GATHER_INFO
2014-03-11	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_10_6.nasl - Type : ACT_GATHER_INFO
2014-03-11	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-050.nasl - Type : ACT_GATHER_INFO
2014-03-11	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2871.nasl - Type : ACT_GATHER_INFO
2014-01-22	Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-131227.nasl - Type : ACT_GATHER_INFO
2013-12-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-296.nasl - Type : ACT_GATHER_INFO
2013-12-20	Name : The remote Fedora host is missing a security update. File : fedora_2013-17635.nasl - Type : ACT_GATHER_INFO
2013-12-18	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_12.nasl - Type : ACT_GATHER_INFO
2013-12-18	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_10_4.nasl - Type : ACT_GATHER_INFO
2013-12-17	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201312-13.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-251.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131121_wireshark_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-11-27	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-1569.nasl - Type : ACT_GATHER_INFO
2013-11-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1569.nasl - Type : ACT_GATHER_INFO
2013-10-03	Name : The remote Fedora host is missing a security update. File : fedora_2013-17627.nasl - Type : ACT_GATHER_INFO
2013-09-28	Name : The remote Fedora host is missing a security update. File : fedora_2013-17661.nasl - Type : ACT_GATHER_INFO
2013-09-20	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-238.nasl - Type : ACT_GATHER_INFO
2013-09-17	Name : The remote Fedora host is missing a security update. File : fedora_2013-16696.nasl - Type : ACT_GATHER_INFO
2013-09-14	Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-130812.nasl - Type : ACT_GATHER_INFO
2013-09-14	Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-130814.nasl - Type : ACT_GATHER_INFO
2013-09-13	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_10_2.nasl - Type : ACT_GATHER_INFO
2013-09-13	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_10.nasl - Type : ACT_GATHER_INFO
2013-09-12	Name : The remote Fedora host is missing a security update. File : fedora_2013-16362.nasl - Type : ACT_GATHER_INFO
2013-08-29	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201308-05.nasl - Type : ACT_GATHER_INFO
2013-08-07	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2734.nasl - Type : ACT_GATHER_INFO
2013-07-31	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-8659.nasl - Type : ACT_GATHER_INFO
2013-07-31	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-204.nasl - Type : ACT_GATHER_INFO
2013-07-29	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_9.nasl - Type : ACT_GATHER_INFO
2013-07-29	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_10_1.nasl - Type : ACT_GATHER_INFO
2013-07-28	Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-130711.nasl - Type : ACT_GATHER_INFO
2013-06-18	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2709.nasl - Type : ACT_GATHER_INFO
2013-06-14	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_8.nasl - Type : ACT_GATHER_INFO
2013-06-14	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_16.nasl - Type : ACT_GATHER_INFO
2013-06-13	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-172.nasl - Type : ACT_GATHER_INFO
2013-06-03	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2700.nasl - Type : ACT_GATHER_INFO
2013-05-22	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_7.nasl - Type : ACT_GATHER_INFO
2013-05-22	Name : The remote Windows host contains an application that is affected by a denial ... File : wireshark_1_6_15.nasl - Type : ACT_GATHER_INFO
2013-04-29	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_wireshark-8500.nasl - Type : ACT_GATHER_INFO
2013-04-20	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-055.nasl - Type : ACT_GATHER_INFO
2013-03-13	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_14.nasl - Type : ACT_GATHER_INFO
2013-02-05	Name : The remote SuSE 11 host is missing a security update. File : suse_11_wireshark-130116.nasl - Type : ACT_GATHER_INFO
2012-11-29	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_8_4.nasl - Type : ACT_GATHER_INFO
2012-11-29	Name : The remote Windows host contains an application that is affected by multiple ... File : wireshark_1_6_12.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-04-02 13:22:37	Multiple Updates
2014-03-31 21:19:56	First insertion

Global Informations

Type	Count
CWE ID(s)	18
Oval ID(s)	29
CPE ID(s)	40
ExploitDB Exploit(s)	1
Openvas Exploit(s)	4
IAVM(s)	2
Snort® Rule(s)	2
Nessus® Exploit(s)	74

	Related
9.3	CVE-2014-2299
7.8	CVE-2013-4927
5	CVE-2013-7112
5	CVE-2013-4933
5	CVE-2013-4932
5	CVE-2013-4931
5	CVE-2013-4083
5	CVE-2013-4081
5	CVE-2013-3559
5	CVE-2013-3557
5	CVE-2012-6062
5	CVE-2012-6061
5	CVE-2012-6060
5	CVE-2012-6056
4.3	CVE-2014-2281
4.3	CVE-2013-5721
4.3	CVE-2013-4935
4.3	CVE-2013-4934
0	CVE-2012-5600
0	CVE-2012-5599
0	CVE-2012-5598
0	CVE-2012-5595
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 22 more Alert(s)