Security update for wireshark SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0653-1 Final 1 1 2014-11-14T12:53:20Z current 2014-11-14T12:53:20Z 2014-11-14T12:53:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wireshark wireshark has been updated to version 1.10.11 to fix five security issues. These security issues have been fixed: * SigComp UDVM buffer overflow (CVE-2014-8710). * AMQP dissector crash (CVE-2014-8711). * NCP dissector crashes (CVE-2014-8712, CVE-2014-8713). * TN5250 infinite loops (CVE-2014-8714). This non-security issue has been fixed: * enable zlib (bnc#899303). Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.11.html <https://www.wireshark.org/docs/relnotes/wireshark-1.10.11.html> Security Issues: * CVE-2014-8711 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8711> * CVE-2014-8710 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8710> * CVE-2014-8714 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8714> * CVE-2014-8712 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8712> * CVE-2014-8713 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8713> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-wireshark,sledsp3-wireshark,slessp3-wireshark Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ Link for SUSE-SU-2015:0653-1 https://lists.suse.com/pipermail/sle-security-updates/2015-April/001323.html E-Mail link for SUSE-SU-2015:0653-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/813217 SUSE Bug 813217 https://bugzilla.suse.com/816517 SUSE Bug 816517 https://bugzilla.suse.com/816887 SUSE Bug 816887 https://bugzilla.suse.com/820973 SUSE Bug 820973 https://bugzilla.suse.com/824900 SUSE Bug 824900 https://bugzilla.suse.com/831718 SUSE Bug 831718 https://bugzilla.suse.com/839607 SUSE Bug 839607 https://bugzilla.suse.com/848738 SUSE Bug 848738 https://bugzilla.suse.com/855980 SUSE Bug 855980 https://bugzilla.suse.com/856495 SUSE Bug 856495 https://bugzilla.suse.com/856496 SUSE Bug 856496 https://bugzilla.suse.com/856498 SUSE Bug 856498 https://bugzilla.suse.com/867485 SUSE Bug 867485 https://bugzilla.suse.com/889854 SUSE Bug 889854 https://bugzilla.suse.com/889899 SUSE Bug 889899 https://bugzilla.suse.com/889900 SUSE Bug 889900 https://bugzilla.suse.com/889901 SUSE Bug 889901 https://bugzilla.suse.com/889906 SUSE Bug 889906 https://bugzilla.suse.com/897055 SUSE Bug 897055 https://bugzilla.suse.com/899303 SUSE Bug 899303 https://bugzilla.suse.com/905245 SUSE Bug 905245 https://bugzilla.suse.com/905246 SUSE Bug 905246 https://bugzilla.suse.com/905247 SUSE Bug 905247 https://bugzilla.suse.com/905248 SUSE Bug 905248 https://bugzilla.suse.com/912365 SUSE Bug 912365 https://bugzilla.suse.com/912368 SUSE Bug 912368 https://bugzilla.suse.com/912369 SUSE Bug 912369 https://bugzilla.suse.com/912370 SUSE Bug 912370 https://bugzilla.suse.com/912372 SUSE Bug 912372 https://bugzilla.suse.com/920696 SUSE Bug 920696 https://bugzilla.suse.com/920697 SUSE Bug 920697 https://bugzilla.suse.com/920699 SUSE Bug 920699 https://bugzilla.suse.com/930691 SUSE Bug 930691 https://www.suse.com/security/cve/CVE-2013-2486/ SUSE CVE CVE-2013-2486 page https://www.suse.com/security/cve/CVE-2013-2487/ SUSE CVE CVE-2013-2487 page https://www.suse.com/security/cve/CVE-2013-3555/ SUSE CVE CVE-2013-3555 page https://www.suse.com/security/cve/CVE-2013-3556/ SUSE CVE CVE-2013-3556 page https://www.suse.com/security/cve/CVE-2013-3557/ SUSE CVE CVE-2013-3557 page https://www.suse.com/security/cve/CVE-2013-3558/ SUSE CVE CVE-2013-3558 page https://www.suse.com/security/cve/CVE-2013-3559/ SUSE CVE CVE-2013-3559 page https://www.suse.com/security/cve/CVE-2013-3560/ SUSE CVE CVE-2013-3560 page https://www.suse.com/security/cve/CVE-2013-3561/ SUSE CVE CVE-2013-3561 page https://www.suse.com/security/cve/CVE-2013-3562/ SUSE CVE CVE-2013-3562 page https://www.suse.com/security/cve/CVE-2013-4074/ SUSE CVE CVE-2013-4074 page https://www.suse.com/security/cve/CVE-2013-4075/ SUSE CVE CVE-2013-4075 page https://www.suse.com/security/cve/CVE-2013-4076/ SUSE CVE CVE-2013-4076 page https://www.suse.com/security/cve/CVE-2013-4077/ SUSE CVE CVE-2013-4077 page https://www.suse.com/security/cve/CVE-2013-4078/ SUSE CVE CVE-2013-4078 page https://www.suse.com/security/cve/CVE-2013-4079/ SUSE CVE CVE-2013-4079 page https://www.suse.com/security/cve/CVE-2013-4080/ SUSE CVE CVE-2013-4080 page https://www.suse.com/security/cve/CVE-2013-4081/ SUSE CVE CVE-2013-4081 page https://www.suse.com/security/cve/CVE-2013-4082/ SUSE CVE CVE-2013-4082 page https://www.suse.com/security/cve/CVE-2013-4083/ SUSE CVE CVE-2013-4083 page https://www.suse.com/security/cve/CVE-2013-4929/ SUSE CVE CVE-2013-4929 page https://www.suse.com/security/cve/CVE-2013-4930/ SUSE CVE CVE-2013-4930 page https://www.suse.com/security/cve/CVE-2013-4931/ SUSE CVE CVE-2013-4931 page https://www.suse.com/security/cve/CVE-2013-4932/ SUSE CVE CVE-2013-4932 page https://www.suse.com/security/cve/CVE-2013-4933/ SUSE CVE CVE-2013-4933 page https://www.suse.com/security/cve/CVE-2013-4934/ SUSE CVE CVE-2013-4934 page https://www.suse.com/security/cve/CVE-2013-4935/ SUSE CVE CVE-2013-4935 page https://www.suse.com/security/cve/CVE-2013-6336/ SUSE CVE CVE-2013-6336 page https://www.suse.com/security/cve/CVE-2013-6337/ SUSE CVE CVE-2013-6337 page https://www.suse.com/security/cve/CVE-2013-6338/ SUSE CVE CVE-2013-6338 page https://www.suse.com/security/cve/CVE-2013-6339/ SUSE CVE CVE-2013-6339 page https://www.suse.com/security/cve/CVE-2013-6340/ SUSE CVE CVE-2013-6340 page https://www.suse.com/security/cve/CVE-2013-7112/ SUSE CVE CVE-2013-7112 page https://www.suse.com/security/cve/CVE-2013-7113/ SUSE CVE CVE-2013-7113 page https://www.suse.com/security/cve/CVE-2013-7114/ SUSE CVE CVE-2013-7114 page https://www.suse.com/security/cve/CVE-2014-2281/ SUSE CVE CVE-2014-2281 page https://www.suse.com/security/cve/CVE-2014-2282/ SUSE CVE CVE-2014-2282 page https://www.suse.com/security/cve/CVE-2014-2283/ SUSE CVE CVE-2014-2283 page https://www.suse.com/security/cve/CVE-2014-2299/ SUSE CVE CVE-2014-2299 page https://www.suse.com/security/cve/CVE-2014-6421/ SUSE CVE CVE-2014-6421 page https://www.suse.com/security/cve/CVE-2014-6422/ SUSE CVE CVE-2014-6422 page https://www.suse.com/security/cve/CVE-2014-6423/ SUSE CVE CVE-2014-6423 page https://www.suse.com/security/cve/CVE-2014-6424/ SUSE CVE CVE-2014-6424 page https://www.suse.com/security/cve/CVE-2014-6427/ SUSE CVE CVE-2014-6427 page https://www.suse.com/security/cve/CVE-2014-6428/ SUSE CVE CVE-2014-6428 page https://www.suse.com/security/cve/CVE-2014-6429/ SUSE CVE CVE-2014-6429 page https://www.suse.com/security/cve/CVE-2014-6430/ SUSE CVE CVE-2014-6430 page https://www.suse.com/security/cve/CVE-2014-6431/ SUSE CVE CVE-2014-6431 page https://www.suse.com/security/cve/CVE-2014-6432/ SUSE CVE CVE-2014-6432 page https://www.suse.com/security/cve/CVE-2014-8710/ SUSE CVE CVE-2014-8710 page https://www.suse.com/security/cve/CVE-2014-8711/ SUSE CVE CVE-2014-8711 page https://www.suse.com/security/cve/CVE-2014-8712/ SUSE CVE CVE-2014-8712 page https://www.suse.com/security/cve/CVE-2014-8713/ SUSE CVE CVE-2014-8713 page https://www.suse.com/security/cve/CVE-2014-8714/ SUSE CVE CVE-2014-8714 page https://www.suse.com/security/cve/CVE-2015-0559/ SUSE CVE CVE-2015-0559 page https://www.suse.com/security/cve/CVE-2015-0560/ SUSE CVE CVE-2015-0560 page https://www.suse.com/security/cve/CVE-2015-0561/ SUSE CVE CVE-2015-0561 page https://www.suse.com/security/cve/CVE-2015-0562/ SUSE CVE CVE-2015-0562 page https://www.suse.com/security/cve/CVE-2015-0563/ SUSE CVE CVE-2015-0563 page https://www.suse.com/security/cve/CVE-2015-0564/ SUSE CVE CVE-2015-0564 page https://www.suse.com/security/cve/CVE-2015-2188/ SUSE CVE CVE-2015-2188 page https://www.suse.com/security/cve/CVE-2015-2189/ SUSE CVE CVE-2015-2189 page https://www.suse.com/security/cve/CVE-2015-2191/ SUSE CVE CVE-2015-2191 page https://www.suse.com/security/cve/CVE-2015-3811/ SUSE CVE CVE-2015-3811 page https://www.suse.com/security/cve/CVE-2015-3812/ SUSE CVE CVE-2015-3812 page https://www.suse.com/security/cve/CVE-2015-3814/ SUSE CVE CVE-2015-3814 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 wireshark-1.10.11-0.2.1 wireshark-devel-1.10.11-0.2.1 wireshark-1.10.11-0.2.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 wireshark-1.10.11-0.2.1 as a component of SUSE Linux Enterprise Server 11 SP3 wireshark-1.10.11-0.2.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA wireshark-1.10.11-0.2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 wireshark-1.10.11-0.2.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 wireshark-devel-1.10.11-0.2.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 The dissect_diagnosticrequest function in epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark 1.8.x before 1.8.6 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (infinite loop) via crafted integer values in a packet. CVE-2013-2486 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-2486.html CVE-2013-2486 https://bugzilla.suse.com/807942 SUSE Bug 807942 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark 1.8.x before 1.8.6 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via crafted integer values in a packet, related to the (1) dissect_icecandidates, (2) dissect_kinddata, (3) dissect_nodeid_list, (4) dissect_storeans, (5) dissect_storereq, (6) dissect_storeddataspecifier, (7) dissect_fetchreq, (8) dissect_findans, (9) dissect_diagnosticinfo, (10) dissect_diagnosticresponse, (11) dissect_reload_messagecontents, and (12) dissect_reload_message functions, a different vulnerability than CVE-2013-2486. CVE-2013-2487 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-2487.html CVE-2013-2487 https://bugzilla.suse.com/807942 SUSE Bug 807942 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. CVE-2013-3555 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3555.html CVE-2013-3555 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER dissector in Wireshark before r48943 has an incorrect pointer dereference during a comparison, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. CVE-2013-3556 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3556.html CVE-2013-3556 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. CVE-2013-3557 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3557.html CVE-2013-3557 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a bit-field list, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. CVE-2013-3558 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3558.html CVE-2013-3558 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application crash) via a malformed packet. CVE-2013-3559 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3559.html CVE-2013-3559 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet. CVE-2013-3560 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3560.html CVE-2013-3560 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet, related to a crash of the Websocket dissector, an infinite loop in the MySQL dissector, and a large loop in the ETCH dissector. CVE-2013-3561 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3561.html CVE-2013-3561 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet. CVE-2013-3562 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-3562.html CVE-2013-3562 https://bugzilla.suse.com/820566 SUSE Bug 820566 https://bugzilla.suse.com/820973 SUSE Bug 820973 The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 incorrectly uses a -1 data value to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-4074 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4074.html CVE-2013-4074 https://bugzilla.suse.com/824900 SUSE Bug 824900 epan/dissectors/packet-gmr1_bcch.c in the GMR-1 BCCH dissector in Wireshark 1.8.x before 1.8.8 does not properly initialize memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-4075 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4075.html CVE-2013-4075 https://bugzilla.suse.com/824900 SUSE Bug 824900 https://bugzilla.suse.com/836146 SUSE Bug 836146 Buffer overflow in the dissect_iphc_crtp_fh function in epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-4076 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4076.html CVE-2013-4076 https://bugzilla.suse.com/824900 SUSE Bug 824900 Array index error in the NBAP dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to nbap.cnf and packet-nbap.c. CVE-2013-4077 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4077.html CVE-2013-4077 https://bugzilla.suse.com/824900 SUSE Bug 824900 epan/dissectors/packet-rdp.c in the RDP dissector in Wireshark 1.8.x before 1.8.8 does not validate return values during checks for data availability, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-4078 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4078.html CVE-2013-4078 https://bugzilla.suse.com/824900 SUSE Bug 824900 The dissect_schedule_message function in epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (infinite loop and application hang) via a crafted packet. CVE-2013-4079 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4079.html CVE-2013-4079 https://bugzilla.suse.com/824900 SUSE Bug 824900 https://bugzilla.suse.com/836146 SUSE Bug 836146 The dissect_r3_upstreamcommand_queryconfig function in epan/dissectors/packet-assa_r3.c in the Assa Abloy R3 dissector in Wireshark 1.8.x before 1.8.8 does not properly handle a zero-length item, which allows remote attackers to cause a denial of service (infinite loop, and CPU and memory consumption) via a crafted packet. CVE-2013-4080 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4080.html CVE-2013-4080 https://bugzilla.suse.com/824900 SUSE Bug 824900 The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which allows remote attackers to cause a denial of service (stack consumption) via a crafted packet. CVE-2013-4081 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4081.html CVE-2013-4081 https://bugzilla.suse.com/824900 SUSE Bug 824900 https://bugzilla.suse.com/836116 SUSE Bug 836116 The vwr_read function in wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 1.8.x before 1.8.8 does not validate the relationship between a record length and a trailer length, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted packet. CVE-2013-4082 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4082.html CVE-2013-4082 https://bugzilla.suse.com/824900 SUSE Bug 824900 The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.6.x before 1.6.16, 1.8.x before 1.8.8, and 1.10.0 does not validate a certain fragment length value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-4083 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4083.html CVE-2013-4083 https://bugzilla.suse.com/824900 SUSE Bug 824900 https://bugzilla.suse.com/831718 SUSE Bug 831718 The parseFields function in epan/dissectors/packet-dis-pdus.c in the DIS dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not terminate packet-data processing after finding zero remaining bytes, which allows remote attackers to cause a denial of service (loop) via a crafted packet. CVE-2013-4929 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4929.html CVE-2013-4929 https://bugzilla.suse.com/831718 SUSE Bug 831718 The dissect_dvbci_tpdu_hdr function in epan/dissectors/packet-dvbci.c in the DVB-CI dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not validate a certain length value before decrementing it, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet. CVE-2013-4930 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4930.html CVE-2013-4930 https://bugzilla.suse.com/831718 SUSE Bug 831718 epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector. CVE-2013-4931 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4931.html CVE-2013-4931 https://bugzilla.suse.com/831718 SUSE Bug 831718 Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-4932 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4932.html CVE-2013-4932 https://bugzilla.suse.com/831718 SUSE Bug 831718 The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file. CVE-2013-4933 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4933.html CVE-2013-4933 https://bugzilla.suse.com/831718 SUSE Bug 831718 The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file. CVE-2013-4934 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4934.html CVE-2013-4934 https://bugzilla.suse.com/831718 SUSE Bug 831718 The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-4935 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-4935.html CVE-2013-4935 https://bugzilla.suse.com/831718 SUSE Bug 831718 The ieee802154_map_rec function in epan/dissectors/packet-ieee802154.c in the IEEE 802.15.4 dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 uses an incorrect pointer chain, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-6336 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-6336.html CVE-2013-6336 https://bugzilla.suse.com/848738 SUSE Bug 848738 Unspecified vulnerability in the NBAP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-6337 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-6337.html CVE-2013-6337 https://bugzilla.suse.com/848738 SUSE Bug 848738 The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-6338 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-6338.html CVE-2013-6338 https://bugzilla.suse.com/848738 SUSE Bug 848738 The dissect_openwire_type function in epan/dissectors/packet-openwire.c in the OpenWire dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (loop) via a crafted packet. CVE-2013-6339 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-6339.html CVE-2013-6339 https://bugzilla.suse.com/848738 SUSE Bug 848738 epan/dissectors/packet-tcp.c in the TCP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly determine the amount of remaining data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-6340 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-6340.html CVE-2013-6340 https://bugzilla.suse.com/848738 SUSE Bug 848738 The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. CVE-2013-7112 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-7112.html CVE-2013-7112 https://bugzilla.suse.com/856498 SUSE Bug 856498 epan/dissectors/packet-bssgp.c in the BSSGP dissector in Wireshark 1.10.x before 1.10.4 incorrectly relies on a global variable, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2013-7113 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-7113.html CVE-2013-7113 https://bugzilla.suse.com/856495 SUSE Bug 856495 Multiple buffer overflows in the create_ntlmssp_v2_key function in epan/dissectors/packet-ntlmssp.c in the NTLMSSP v2 dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 allow remote attackers to cause a denial of service (application crash) via a long domain name in a packet. CVE-2013-7114 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 important 7.8 AV:N/AC:M/Au:N/C:N/I:P/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2013-7114.html CVE-2013-7114 https://bugzilla.suse.com/856496 SUSE Bug 856496 The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet. CVE-2014-2281 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-2281.html CVE-2014-2281 https://bugzilla.suse.com/867485 SUSE Bug 867485 The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet. CVE-2014-2282 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-2282.html CVE-2014-2282 https://bugzilla.suse.com/867485 SUSE Bug 867485 epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet. CVE-2014-2283 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-2283.html CVE-2014-2283 https://bugzilla.suse.com/867485 SUSE Bug 867485 Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data. CVE-2014-2299 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-2299.html CVE-2014-2299 https://bugzilla.suse.com/867485 SUSE Bug 867485 Use-after-free vulnerability in the SDP dissector in Wireshark 1.10.x before 1.10.10 allows remote attackers to cause a denial of service (application crash) via a crafted packet that leverages split memory ownership between the SDP and RTP dissectors. CVE-2014-6421 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6421.html CVE-2014-6421 https://bugzilla.suse.com/897055 SUSE Bug 897055 The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector. CVE-2014-6422 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6422.html CVE-2014-6422 https://bugzilla.suse.com/897055 SUSE Bug 897055 The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line. CVE-2014-6423 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6423.html CVE-2014-6423 https://bugzilla.suse.com/897055 SUSE Bug 897055 The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet. CVE-2014-6424 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6424.html CVE-2014-6424 https://bugzilla.suse.com/897055 SUSE Bug 897055 Off-by-one error in the is_rtsp_request_or_reply function in epan/dissectors/packet-rtsp.c in the RTSP dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers parsing of a token located one position beyond the current position. CVE-2014-6427 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6427.html CVE-2014-6427 https://bugzilla.suse.com/897055 SUSE Bug 897055 The dissect_spdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2014-6428 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6428.html CVE-2014-6428 https://bugzilla.suse.com/897055 SUSE Bug 897055 The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not properly handle empty input data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. CVE-2014-6429 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6429.html CVE-2014-6429 https://bugzilla.suse.com/897055 SUSE Bug 897055 The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service (application crash) via a crafted file. CVE-2014-6430 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6430.html CVE-2014-6430 https://bugzilla.suse.com/897055 SUSE Bug 897055 Buffer overflow in the SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers writes of uncompressed bytes beyond the end of the output buffer. CVE-2014-6431 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6431.html CVE-2014-6431 https://bugzilla.suse.com/897055 SUSE Bug 897055 The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not prevent data overwrites during copy operations, which allows remote attackers to cause a denial of service (application crash) via a crafted file. CVE-2014-6432 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-6432.html CVE-2014-6432 https://bugzilla.suse.com/897055 SUSE Bug 897055 The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet. CVE-2014-8710 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-8710.html CVE-2014-8710 https://bugzilla.suse.com/905246 SUSE Bug 905246 Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet. CVE-2014-8711 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-8711.html CVE-2014-8711 https://bugzilla.suse.com/905245 SUSE Bug 905245 The build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2014-8712 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-8712.html CVE-2014-8712 https://bugzilla.suse.com/905248 SUSE Bug 905248 Stack-based buffer overflow in the build_expert_data function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2014-8713 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-8713.html CVE-2014-8713 https://bugzilla.suse.com/905248 SUSE Bug 905248 The dissect_write_structured_field function in epan/dissectors/packet-tn5250.c in the TN5250 dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. CVE-2014-8714 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2014-8714.html CVE-2014-8714 https://bugzilla.suse.com/905247 SUSE Bug 905247 Multiple use-after-free vulnerabilities in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory. CVE-2015-0559 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-0559.html CVE-2015-0559 https://bugzilla.suse.com/912365 SUSE Bug 912365 The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2015-0560 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-0560.html CVE-2015-0560 https://bugzilla.suse.com/912365 SUSE Bug 912365 asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet. CVE-2015-0561 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-0561.html CVE-2015-0561 https://bugzilla.suse.com/912368 SUSE Bug 912368 Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory. CVE-2015-0562 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-0562.html CVE-2015-0562 https://bugzilla.suse.com/912369 SUSE Bug 912369 epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. CVE-2015-0563 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-0563.html CVE-2015-0563 https://bugzilla.suse.com/912370 SUSE Bug 912370 Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session. CVE-2015-0564 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-0564.html CVE-2015-0564 https://bugzilla.suse.com/912372 SUSE Bug 912372 epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression. CVE-2015-2188 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-2188.html CVE-2015-2188 https://bugzilla.suse.com/920696 SUSE Bug 920696 Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet. CVE-2015-2189 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-2189.html CVE-2015-2189 https://bugzilla.suse.com/920697 SUSE Bug 920697 Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet. CVE-2015-2191 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-2191.html CVE-2015-2191 https://bugzilla.suse.com/920699 SUSE Bug 920699 epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-2188. CVE-2015-3811 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-3811.html CVE-2015-3811 https://bugzilla.suse.com/930689 SUSE Bug 930689 https://bugzilla.suse.com/930691 SUSE Bug 930691 Multiple memory leaks in the x11_init_protocol function in epan/dissectors/packet-x11.c in the X11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 allow remote attackers to cause a denial of service (memory consumption) via a crafted packet. CVE-2015-3812 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-3812.html CVE-2015-3812 https://bugzilla.suse.com/930689 SUSE Bug 930689 https://bugzilla.suse.com/930691 SUSE Bug 930691 The (1) dissect_tfs_request and (2) dissect_tfs_response functions in epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 interpret a zero value as a length rather than an error condition, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. CVE-2015-3814 SUSE Linux Enterprise Desktop 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-1.10.11-0.2.1 SUSE Linux Enterprise Software Development Kit 11 SP3:wireshark-devel-1.10.11-0.2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150653-1/ https://www.suse.com/security/cve/CVE-2015-3814.html CVE-2015-3814 https://bugzilla.suse.com/930689 SUSE Bug 930689 https://bugzilla.suse.com/930691 SUSE Bug 930691