SUSE-SU-2013:1265-1: moderate: Security update for wireshark

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Sat Jul 27 09:04:26 MDT 2013


   SUSE Security Update: Security update for wireshark
______________________________________________________________________________

Announcement ID:    SUSE-SU-2013:1265-1
Rating:             moderate
References:         #813217 #816517 #816887 #820973 #824900 
Cross-References:   CVE-2013-2486 CVE-2013-2487 CVE-2013-3555
                    CVE-2013-3556 CVE-2013-3557 CVE-2013-3558
                    CVE-2013-3559 CVE-2013-3560 CVE-2013-3561
                    CVE-2013-3562 CVE-2013-4074 CVE-2013-4075
                    CVE-2013-4076 CVE-2013-4077 CVE-2013-4078
                    CVE-2013-4079 CVE-2013-4080 CVE-2013-4081
                    CVE-2013-4082 CVE-2013-4083
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11 SP3
                    SUSE Linux Enterprise Software Development Kit 11 SP2
                    SUSE Linux Enterprise Server 11 SP3 for VMware
                    SUSE Linux Enterprise Server 11 SP3
                    SUSE Linux Enterprise Server 11 SP2 for VMware
                    SUSE Linux Enterprise Server 11 SP2
                    SUSE Linux Enterprise Desktop 11 SP3
                    SUSE Linux Enterprise Desktop 11 SP2
______________________________________________________________________________

   An update that fixes 20 vulnerabilities is now available.
   It includes one version update.

Description:


   This wireshark version update to 1.8.8 includes several
   security and  general bug fixes.

   Version update to 1.8.8 [bnc#824900]:

   * vulnerabilities fixed: o The CAPWAP dissector could
   crash. wnpa-sec-2013-32 CVE-2013-4074 o The GMR-1 BCCH
   dissector could crash. wnpa-sec-2013-33 CVE-2013-4075 o The
   PPP dissector could crash. wnpa-sec-2013-34 CVE-2013-4076 o
   The NBAP dissector could crash. wnpa-sec-2013-35
   CVE-2013-4077 o The RDP dissector could crash.
   wnpa-sec-2013-36 CVE-2013-4078 o The GSM CBCH dissector
   could crash. wnpa-sec-2013-37 CVE-2013-4079 o The Assa
   Abloy R3 dissector could consume excessive memory and CPU.
   wnpa-sec-2013-38 CVE-2013-4080 o The HTTP dissector could
   overrun the stack. wnpa-sec-2013-39 CVE-2013-4081 o The
   Ixia IxVeriWave file parser could overflow the heap.
   wnpa-sec-2013-40 CVE-2013-4082 o The DCP ETSI dissector
   could crash. wnpa-sec-2013-41 CVE-2013-4083
   * Further bug fixes and updated protocol support as
   listed in:
   https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html
   <https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.htm
   l>

   Version update to 1.8.7 [bnc#813217, bnc#820973]:

   * vulnerabilities fixed: o The RELOAD dissector could
   go into an infinite loop. wnpa-sec-2013-23 CVE-2013-2486
   CVE-2013-2487 o The GTPv2 dissector could crash.
   wnpa-sec-2013-24 o The ASN.1 BER dissector could crash.
   wnpa-sec-2013-25 o The PPP CCP dissector could crash.
   wnpa-sec-2013-26 o The DCP ETSI dissector could crash.
   wnpa-sec-2013-27 o The MPEG DSM-CC dissector could crash.
   wnpa-sec-2013-28 o The Websocket dissector could crash.
   wnpa-sec-2013-29 o The MySQL dissector could go into an
   infinite loop. wnpa-sec-2013-30 o The ETCH dissector could
   go into a large loop. wnpa-sec-2013-31
   * Further bug fixes and updated protocol support as
   listed in:
   https://www.wireshark.org/docs/relnotes/wireshark-1.8.7.html
   <https://www.wireshark.org/docs/relnotes/wireshark-1.8.7.htm
   l>

   Ohter bug fixes:

   * bnc#816517: 'Save As' Nokia libpcap corrupting the
   file
   * bnc#816887: wireshark crashed in 'SCTP' -> 'Prepare
   Filter for this Association'

   Security Issue references:

   * CVE-2013-2486
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2486
   >
   * CVE-2013-2487
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2487
   >
   * CVE-2013-3555
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3555
   >
   * CVE-2013-3556
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3556
   >
   * CVE-2013-3557
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3557
   >
   * CVE-2013-3558
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3558
   >
   * CVE-2013-3559
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3559
   >
   * CVE-2013-3560
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3560
   >
   * CVE-2013-3561
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3561
   >
   * CVE-2013-3562
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3562
   >
   * CVE-2013-3561
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3561
   >
   * CVE-2013-3561
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3561
   >
   * CVE-2013-4074
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4074
   >
   * CVE-2013-4075
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4075
   >
   * CVE-2013-4076
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4076
   >
   * CVE-2013-4077
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4077
   >
   * CVE-2013-4078
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4078
   >
   * CVE-2013-4079
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4079
   >
   * CVE-2013-4080
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4080
   >
   * CVE-2013-4081
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4081
   >
   * CVE-2013-4082
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4082
   >
   * CVE-2013-4083
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4083
   >


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11 SP3:

      zypper in -t patch sdksp3-wireshark-8045

   - SUSE Linux Enterprise Software Development Kit 11 SP2:

      zypper in -t patch sdksp2-wireshark-8044

   - SUSE Linux Enterprise Server 11 SP3 for VMware:

      zypper in -t patch slessp3-wireshark-8045

   - SUSE Linux Enterprise Server 11 SP3:

      zypper in -t patch slessp3-wireshark-8045

   - SUSE Linux Enterprise Server 11 SP2 for VMware:

      zypper in -t patch slessp2-wireshark-8044

   - SUSE Linux Enterprise Server 11 SP2:

      zypper in -t patch slessp2-wireshark-8044

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-wireshark-8045

   - SUSE Linux Enterprise Desktop 11 SP2:

      zypper in -t patch sledsp2-wireshark-8044

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.8.8]:

      wireshark-devel-1.8.8-0.2.1

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1

   - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.8.8]:

      wireshark-devel-1.8.8-0.2.1

   - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1

   - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1

   - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1

   - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1

   - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1

   - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 1.8.8]:

      wireshark-1.8.8-0.2.1


References:

   http://support.novell.com/security/cve/CVE-2013-2486.html
   http://support.novell.com/security/cve/CVE-2013-2487.html
   http://support.novell.com/security/cve/CVE-2013-3555.html
   http://support.novell.com/security/cve/CVE-2013-3556.html
   http://support.novell.com/security/cve/CVE-2013-3557.html
   http://support.novell.com/security/cve/CVE-2013-3558.html
   http://support.novell.com/security/cve/CVE-2013-3559.html
   http://support.novell.com/security/cve/CVE-2013-3560.html
   http://support.novell.com/security/cve/CVE-2013-3561.html
   http://support.novell.com/security/cve/CVE-2013-3562.html
   http://support.novell.com/security/cve/CVE-2013-4074.html
   http://support.novell.com/security/cve/CVE-2013-4075.html
   http://support.novell.com/security/cve/CVE-2013-4076.html
   http://support.novell.com/security/cve/CVE-2013-4077.html
   http://support.novell.com/security/cve/CVE-2013-4078.html
   http://support.novell.com/security/cve/CVE-2013-4079.html
   http://support.novell.com/security/cve/CVE-2013-4080.html
   http://support.novell.com/security/cve/CVE-2013-4081.html
   http://support.novell.com/security/cve/CVE-2013-4082.html
   http://support.novell.com/security/cve/CVE-2013-4083.html
   https://bugzilla.novell.com/813217
   https://bugzilla.novell.com/816517
   https://bugzilla.novell.com/816887
   https://bugzilla.novell.com/820973
   https://bugzilla.novell.com/824900
   http://download.novell.com/patch/finder/?keywords=01bde4a9b83d054d421819162ba7b352
   http://download.novell.com/patch/finder/?keywords=9e62de2dfb272343bbe45e5f61e345fa



More information about the sle-security-updates mailing list