[Bug 848738] New: VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

bugzilla_noreply＠novell.com

1 Nov 2013 1 Nov '13

21:25

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c0 Summary: VUL-0: wireshark: security updates to 1.8.11 and 1.10.3 Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: Andreas.Stieger@gmx.de QAContact: qa-bugs@suse.de CC: Andreas.Stieger@gmx.de, abergmann@suse.com, cyliu@suse.com Depends on: 839607 Found By: --- Blocker: --- Via http://www.wireshark.org/docs/relnotes/wireshark-1.10.3.html The following vulnerabilities have been fixed. wnpa-sec-2013-61 The IEEE 802.15.4 dissector could crash. (Bug 9139) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6336 wnpa-sec-2013-62 The NBAP dissector could crash. Discovered by Laurent Butti. (Bug 9168) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6337 wnpa-sec-2013-63 The SIP dissector could crash. (Bug 9228) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6338 wnpa-sec-2013-64 The OpenWire dissector could go into a large loop. Discovered by Murali. (Bug 9248) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6339 wnpa-sec-2013-65 The TCP dissector could crash. (Bug 9263) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6340 http://www.wireshark.org/docs/relnotes/wireshark-1.8.11.html The following vulnerabilities have been fixed. wnpa-sec-2013-61 The IEEE 802.15.4 dissector could crash. (Bug 9139) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6336 wnpa-sec-2013-62 The NBAP dissector could crash. Discovered by Laurent Butti. (Bug 9168) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6337 wnpa-sec-2013-63 The SIP dissector could crash. (Bug 9228) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6338 wnpa-sec-2013-64 The OpenWire dissector could go into a large loop. Discovered by Murali. (Bug 9248) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6339 wnpa-sec-2013-65 The TCP dissector could crash. (Bug 9263) Versions affected: 1.10.0 to 1.10.2, 1.8.0 to 1.8.10 CVE-2013-6340 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

1 Nov 1 Nov

21:26

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium Status|NEW |ASSIGNED AssignedTo|bnc-team-screening@forge.pr |Andreas.Stieger@gmx.de |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

23:00

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c1 --- Comment #1 from Bernhard Wiedemann 2013-11-02 00:00:20 CET --- This is an autogenerated message for OBS integration: This bug (848738) was mentioned in https://build.opensuse.org/request/show/205585 Factory / wireshark -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

23:18

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c2 Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |security-team@suse.de --- Comment #2 from Andreas Stieger 2013-11-01 23:17:59 UTC --- Maintenance request for openSUSE 12.2, 12.3 and 13.1: https://build.opensuse.org/request/show/205585 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

23:19

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c3 --- Comment #3 from Andreas Stieger 2013-11-01 23:19:04 UTC --- (In reply to comment #2)

...

Maintenance request for openSUSE 12.2, 12.3 and 13.1:

https://build.opensuse.org/request/show/205587 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

4 Nov 4 Nov

08:20

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c4 --- Comment #4 from Andreas Stieger 2013-11-04 08:20:55 UTC --- (In reply to comment #3)

...

(In reply to comment #2)

...
Maintenance request for openSUSE 12.2, 12.3 and 13.1:

https://build.opensuse.org/request/show/205587

1.10.3 was copied to 13.1. maintenance request for 12.2 and 12.3 only: https://build.opensuse.org/request/show/205665 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13:05

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c5 Victor Pereira changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |vpereira@novell.com InfoProvider|security-team@suse.de |bjzhang@suse.com --- Comment #5 from Victor Pereira 2013-11-04 13:05:59 UTC --- are we, SLE, affected as well? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13:21

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c6 --- Comment #6 from Andreas Stieger 2013-11-04 13:21:38 UTC --- (In reply to comment #5)

...

are we, SLE, affected as well?

SLE-11 yes, last update there should be 1.8.10 or so, see Bug 839607 SLE-10 1.6.16 .. 1.6.x is discontinued upstream. Upstream makes no statement about whether discontinued releases are affected. Since all of the items above show from "from 1.8.0" that may very well be the case. Maybe update to 1.8.x as openSUSE did? SLE-9 1.0.16 ancient.... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:30

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c7 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:running:54917:moderat | |e --- Comment #7 from Swamp Workflow Management 2013-11-04 14:30:00 UTC --- The SWAMPID for this issue is 54917. This issue was rated as moderate. Please submit fixed packages until 2013-11-18. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:30

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c SMASH SMASH changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:54917:moderat |maint:running:54917:moderat |e |e maint:planned:update -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

5 Nov 5 Nov

02:49

New subject: [Bug 848738] VUL-0: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c8 Chunyan Liu changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|bjzhang@suse.com | --- Comment #8 from Chunyan Liu 2013-11-05 02:49:17 UTC --- (In reply to comment #6)

...

(In reply to comment #5)

...
are we, SLE, affected as well?

SLE-11 yes, last update there should be 1.8.10 or so, see Bug 839607 I'll update SLE-11.

...

SLE-10 1.6.16 .. 1.6.x is discontinued upstream. Upstream makes no statement about whether discontinued releases are affected. Since all of the items above show from "from 1.8.0" that may very well be the case. Maybe update to 1.8.x as openSUSE did? As mentioned in Bug#792005: wireshark-1.8.x requires gtk+ >= 2.12 and glib >= 2.14, but SLE-10 only has gtk+ 2.8 and glib 2.8, update to 1.8.x failed. So, for a long time, SLE-10 only updates to 1.6.x.

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:44

New subject: [Bug 848738] VUL-0:CVE-2013-6337: wireshark: security updates to 1.8.11 and 1.10.3

https://bugzilla.novell.com/show_bug.cgi?id=848738 https://bugzilla.novell.com/show_bug.cgi?id=848738#c Victor Pereira changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-0: wireshark: security |VUL-0:CVE-2013-6337: |updates to 1.8.11 and |wireshark: security updates |1.10.3 |to 1.8.11 and 1.10.3 Alias| |CVE-2013-6337 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.