CVE-2021-4186

Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

• CVE-2021-4181: sysdig event dissector SIGSEGV fix
• CVE-2021-4182: rfc7468 file parser infinite loop fix
• CVE-2021-4184: bt-dht endless loop fix
• CVE-2021-4186: gryphon NULL pkt_info dereference fix
• CVE-2021-4190: kafka dissector varint strictness fix
• CVE-2022-0581: cms dissector globals-scoping fix
• CVE-2022-0583: pvfs2 heap overflow OOB read fix

Several wireshark vulnerabilities have been fixed. See the release notes for details.

These are all security issues fixed in the libwireshark15-3.6.8-2.1 package on the GA media of openSUSE Tumbleweed.

This update for wireshark fixes the following issues:

Updated to Wireshark 3.6.8:

• CVE-2022-3190: Fixed F5 Ethernet Trailer dissector infinite loop (bsc#1203388).
• CVE-2021-4186: Fixed Gryphon dissector crash (bsc#1194165).

It was discovered that Wireshark did not correctly handle recursion. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39929)

Roman Donchenko discovered that Wireshark did not correctly handle parsing certain files. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-4182)

It was discovered that Wireshark did not correctly handle parsing certain files. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-4185, CVE-2022-0581)

It was discovered that Wireshark did not correctly handle parsing certain files. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-4186)

Sharon Brizinov discovered that Wireshark did not correctly handle parsing certain files. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0582, CVE-2022-0583, CVE-2022-0586)

Sharon Brizinov discovered that Wireshark did not correctly handle parsing certain files. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-0585)

Jason Cohen discovered that Wireshark did not correctly handle parsing certain files. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-3190)