Security update for wireshark SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0722-1 Final 1 1 2022-03-04T09:28:36Z current 2022-03-04T09:28:36Z 2022-03-04T09:28:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wireshark This update for wireshark fixes the following issues: Update to Wireshark 3.6.2: - CVE-2022-0586: RTMPT dissector infinite loop (bsc#1195866) - CVE-2022-0585: Large loops in multiple dissectors (bsc#1195867) - CVE-2022-0583: PVFS dissector crash (bsc#1195868) - CVE-2022-0582: CSN.1 dissector crash (bsc#1195869) - CVE-2022-0581: CMS dissector crash (bsc#1195870) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-722,openSUSE-SLE-15.4-2022-722 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7AGXUOAQTRI5GT64S2AG6NRTU42WI6GH/ E-Mail link for openSUSE-SU-2022:0722-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1195866 SUSE Bug 1195866 https://bugzilla.suse.com/1195867 SUSE Bug 1195867 https://bugzilla.suse.com/1195868 SUSE Bug 1195868 https://bugzilla.suse.com/1195869 SUSE Bug 1195869 https://bugzilla.suse.com/1195870 SUSE Bug 1195870 https://www.suse.com/security/cve/CVE-2022-0581/ SUSE CVE CVE-2022-0581 page https://www.suse.com/security/cve/CVE-2022-0582/ SUSE CVE CVE-2022-0582 page https://www.suse.com/security/cve/CVE-2022-0583/ SUSE CVE CVE-2022-0583 page https://www.suse.com/security/cve/CVE-2022-0585/ SUSE CVE CVE-2022-0585 page https://www.suse.com/security/cve/CVE-2022-0586/ SUSE CVE CVE-2022-0586 page openSUSE Leap 15.3 libwireshark15-3.6.2-3.71.1 libwiretap12-3.6.2-3.71.1 libwsutil13-3.6.2-3.71.1 wireshark-3.6.2-3.71.1 wireshark-devel-3.6.2-3.71.1 wireshark-ui-qt-3.6.2-3.71.1 libwireshark15-3.6.2-3.71.1 as a component of openSUSE Leap 15.3 libwiretap12-3.6.2-3.71.1 as a component of openSUSE Leap 15.3 libwsutil13-3.6.2-3.71.1 as a component of openSUSE Leap 15.3 wireshark-3.6.2-3.71.1 as a component of openSUSE Leap 15.3 wireshark-devel-3.6.2-3.71.1 as a component of openSUSE Leap 15.3 wireshark-ui-qt-3.6.2-3.71.1 as a component of openSUSE Leap 15.3 Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0581 openSUSE Leap 15.3:libwireshark15-3.6.2-3.71.1 openSUSE Leap 15.3:libwiretap12-3.6.2-3.71.1 openSUSE Leap 15.3:libwsutil13-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-devel-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-ui-qt-3.6.2-3.71.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7AGXUOAQTRI5GT64S2AG6NRTU42WI6GH/ https://www.suse.com/security/cve/CVE-2022-0581.html CVE-2022-0581 https://bugzilla.suse.com/1195870 SUSE Bug 1195870 Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0582 openSUSE Leap 15.3:libwireshark15-3.6.2-3.71.1 openSUSE Leap 15.3:libwiretap12-3.6.2-3.71.1 openSUSE Leap 15.3:libwsutil13-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-devel-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-ui-qt-3.6.2-3.71.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7AGXUOAQTRI5GT64S2AG6NRTU42WI6GH/ https://www.suse.com/security/cve/CVE-2022-0582.html CVE-2022-0582 https://bugzilla.suse.com/1195869 SUSE Bug 1195869 Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0583 openSUSE Leap 15.3:libwireshark15-3.6.2-3.71.1 openSUSE Leap 15.3:libwiretap12-3.6.2-3.71.1 openSUSE Leap 15.3:libwsutil13-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-devel-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-ui-qt-3.6.2-3.71.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7AGXUOAQTRI5GT64S2AG6NRTU42WI6GH/ https://www.suse.com/security/cve/CVE-2022-0583.html CVE-2022-0583 https://bugzilla.suse.com/1195868 SUSE Bug 1195868 Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file CVE-2022-0585 openSUSE Leap 15.3:libwireshark15-3.6.2-3.71.1 openSUSE Leap 15.3:libwiretap12-3.6.2-3.71.1 openSUSE Leap 15.3:libwsutil13-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-devel-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-ui-qt-3.6.2-3.71.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7AGXUOAQTRI5GT64S2AG6NRTU42WI6GH/ https://www.suse.com/security/cve/CVE-2022-0585.html CVE-2022-0585 https://bugzilla.suse.com/1195867 SUSE Bug 1195867 Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file CVE-2022-0586 openSUSE Leap 15.3:libwireshark15-3.6.2-3.71.1 openSUSE Leap 15.3:libwiretap12-3.6.2-3.71.1 openSUSE Leap 15.3:libwsutil13-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-devel-3.6.2-3.71.1 openSUSE Leap 15.3:wireshark-ui-qt-3.6.2-3.71.1 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7AGXUOAQTRI5GT64S2AG6NRTU42WI6GH/ https://www.suse.com/security/cve/CVE-2022-0586.html CVE-2022-0586 https://bugzilla.suse.com/1195866 SUSE Bug 1195866