Advisories » MGASA-2018-0071

Updated wireshark packages fix security vulnerabilities

Publication date: 12 Jan 2018
Modification date: 12 Jan 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2017-5753 , CVE-2017-17997 , CVE-2018-5334 , CVE-2018-5335 , CVE-2018-5336

Description

The MRDISC dissector could crash (CVE-2017-17997).

The IxVeriWave file parser could crash (CVE-2018-5334).

The WCP dissector could crash (CVE-2018-5335).

Multiple dissectors could crash (CVE-2018-5336).

Prior to this release dumpcap enabled the Linux kernel’s BPF JIT
compiler via the net.core.bpf_jit_enable sysctl. This could make
systems more vulnerable to Spectre variant 1 and this feature has been
removed (CVE-2017-5753).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=22374
• https://www.wireshark.org/security/wnpa-sec-2018-01.html
• https://www.wireshark.org/security/wnpa-sec-2018-02.html
• https://www.wireshark.org/security/wnpa-sec-2018-03.html
• https://www.wireshark.org/security/wnpa-sec-2018-04.html
• https://www.wireshark.org/docs/relnotes/wireshark-2.2.12.html
• https://www.wireshark.org/news/20180111.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17997
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5334
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5335
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5336

SRPMS

6/core

• wireshark-2.2.12-1.mga6