Security update for wireshark SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2872-1 Final 1 1 2018-09-26T08:56:08Z current 2018-09-26T08:56:08Z 2018-09-26T08:56:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wireshark This update for wireshark fixes the following issues: Update wireshark to version 2.2.17 (bsc#1106514): Security issues fixed: - CVE-2018-16058: Bluetooth AVDTP dissector crash (wnpa-sec-2018-44) - CVE-2018-16056: Bluetooth Attribute Protocol dissector crash (wnpa-sec-2018-45) - CVE-2018-16057: Radiotap dissector crash (wnpa-sec-2018-46) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.17.html The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-wireshark-13792,slessp4-wireshark-13792 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182872-1/ Link for SUSE-SU-2018:2872-1 https://lists.suse.com/pipermail/sle-security-updates/2018-September/004604.html E-Mail link for SUSE-SU-2018:2872-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1106514 SUSE Bug 1106514 https://www.suse.com/security/cve/CVE-2018-16056/ SUSE CVE CVE-2018-16056 page https://www.suse.com/security/cve/CVE-2018-16057/ SUSE CVE CVE-2018-16057 page https://www.suse.com/security/cve/CVE-2018-16058/ SUSE CVE CVE-2018-16058 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libwireshark8-2.2.17-40.31.1 libwiretap6-2.2.17-40.31.1 libwscodecs1-2.2.17-40.31.1 libwsutil7-2.2.17-40.31.1 wireshark-2.2.17-40.31.1 wireshark-devel-2.2.17-40.31.1 wireshark-gtk-2.2.17-40.31.1 libwireshark8-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server 11 SP4 libwiretap6-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server 11 SP4 libwscodecs1-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server 11 SP4 libwsutil7-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server 11 SP4 wireshark-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server 11 SP4 wireshark-gtk-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server 11 SP4 libwireshark8-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libwiretap6-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libwscodecs1-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libwsutil7-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 wireshark-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 wireshark-gtk-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libwireshark8-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libwiretap6-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libwscodecs1-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libwsutil7-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 wireshark-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 wireshark-devel-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 wireshark-gtk-2.2.17-40.31.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth Attribute Protocol dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by verifying that a dissector for a specific UUID exists. CVE-2018-16056 SUSE Linux Enterprise Server 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:wireshark-gtk-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wireshark-gtk-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-devel-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-gtk-2.2.17-40.31.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182872-1/ https://www.suse.com/security/cve/CVE-2018-16056.html CVE-2018-16056 https://bugzilla.suse.com/1106514 SUSE Bug 1106514 In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was addressed in epan/dissectors/packet-ieee80211-radiotap-iter.c by validating iterator operations. CVE-2018-16057 SUSE Linux Enterprise Server 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:wireshark-gtk-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wireshark-gtk-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-devel-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-gtk-2.2.17-40.31.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182872-1/ https://www.suse.com/security/cve/CVE-2018-16057.html CVE-2018-16057 https://bugzilla.suse.com/1106514 SUSE Bug 1106514 In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Bluetooth AVDTP dissector could crash. This was addressed in epan/dissectors/packet-btavdtp.c by properly initializing a data structure. CVE-2018-16058 SUSE Linux Enterprise Server 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Server 11 SP4:wireshark-gtk-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wireshark-gtk-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwireshark8-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwiretap6-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwscodecs1-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libwsutil7-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-devel-2.2.17-40.31.1 SUSE Linux Enterprise Software Development Kit 11 SP4:wireshark-gtk-2.2.17-40.31.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182872-1/ https://www.suse.com/security/cve/CVE-2018-16058.html CVE-2018-16058 https://bugzilla.suse.com/1106514 SUSE Bug 1106514