Security update for wireshark SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:1566-1 Final 1 1 2021-12-10T11:07:01Z current 2021-12-10T11:07:01Z 2021-12-10T11:07:01Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wireshark This update for wireshark fixes the following issues: - Update to Wireshark 3.4.10: - CVE-2021-39920: IPPUSB dissector crash (bsc#1192830). - CVE-2021-39921: Modbus dissector crash (bsc#1192830). - CVE-2021-39922: C12.22 dissector crash (bsc#1192830). - CVE-2021-39924: Bluetooth DHT dissector large loop (bsc#1192830). - CVE-2021-39925: Bluetooth SDP dissector crash (bsc#1192830). - CVE-2021-39926: Bluetooth HCI_ISO dissector crash (bsc#1192830). - CVE-2021-39928: IEEE 802.11 dissector crash (bsc#1192830). - CVE-2021-39929: Bluetooth DHT dissector crash (bsc#1192830). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-1566 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ E-Mail link for openSUSE-SU-2021:1566-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1192830 SUSE Bug 1192830 https://www.suse.com/security/cve/CVE-2021-39920/ SUSE CVE CVE-2021-39920 page https://www.suse.com/security/cve/CVE-2021-39921/ SUSE CVE CVE-2021-39921 page https://www.suse.com/security/cve/CVE-2021-39922/ SUSE CVE CVE-2021-39922 page https://www.suse.com/security/cve/CVE-2021-39924/ SUSE CVE CVE-2021-39924 page https://www.suse.com/security/cve/CVE-2021-39925/ SUSE CVE CVE-2021-39925 page https://www.suse.com/security/cve/CVE-2021-39926/ SUSE CVE CVE-2021-39926 page https://www.suse.com/security/cve/CVE-2021-39928/ SUSE CVE CVE-2021-39928 page https://www.suse.com/security/cve/CVE-2021-39929/ SUSE CVE CVE-2021-39929 page openSUSE Leap 15.2 libwireshark14-3.4.10-lp152.2.21.1 libwiretap11-3.4.10-lp152.2.21.1 libwsutil12-3.4.10-lp152.2.21.1 wireshark-3.4.10-lp152.2.21.1 wireshark-devel-3.4.10-lp152.2.21.1 wireshark-ui-qt-3.4.10-lp152.2.21.1 libwireshark14-3.4.10-lp152.2.21.1 as a component of openSUSE Leap 15.2 libwiretap11-3.4.10-lp152.2.21.1 as a component of openSUSE Leap 15.2 libwsutil12-3.4.10-lp152.2.21.1 as a component of openSUSE Leap 15.2 wireshark-3.4.10-lp152.2.21.1 as a component of openSUSE Leap 15.2 wireshark-devel-3.4.10-lp152.2.21.1 as a component of openSUSE Leap 15.2 wireshark-ui-qt-3.4.10-lp152.2.21.1 as a component of openSUSE Leap 15.2 NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file CVE-2021-39920 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39920.html CVE-2021-39920 https://bugzilla.suse.com/1192830 SUSE Bug 1192830 NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file CVE-2021-39921 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39921.html CVE-2021-39921 https://bugzilla.suse.com/1192830 SUSE Bug 1192830 Buffer overflow in the C12.22 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file CVE-2021-39922 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39922.html CVE-2021-39922 https://bugzilla.suse.com/1192830 SUSE Bug 1192830 Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file CVE-2021-39924 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39924.html CVE-2021-39924 https://bugzilla.suse.com/1192830 SUSE Bug 1192830 Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file CVE-2021-39925 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39925.html CVE-2021-39925 https://bugzilla.suse.com/1192830 SUSE Bug 1192830 Buffer overflow in the Bluetooth HCI_ISO dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture file CVE-2021-39926 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39926.html CVE-2021-39926 https://bugzilla.suse.com/1192830 SUSE Bug 1192830 NULL pointer exception in the IEEE 802.11 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file CVE-2021-39928 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39928.html CVE-2021-39928 https://bugzilla.suse.com/1192830 SUSE Bug 1192830 Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file CVE-2021-39929 openSUSE Leap 15.2:libwireshark14-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwiretap11-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:libwsutil12-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-devel-3.4.10-lp152.2.21.1 openSUSE Leap 15.2:wireshark-ui-qt-3.4.10-lp152.2.21.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R4IHVPZT7B7SN73CHLW4TIYSYZIPKJ7D/ https://www.suse.com/security/cve/CVE-2021-39929.html CVE-2021-39929 https://bugzilla.suse.com/1192830 SUSE Bug 1192830