CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 1CVE-2020-25863
https://notcve.org/view.php?id=CVE-2020-25863
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multipart.c by correcting the deallocation of invalid MIME parts. En Wireshark versiones 3.2.0 hasta 3.2.6, versiones 3.0.0 hasta 3.0.13 y versiones 2.6.0 hasta 2.6.20, el disector MIME Multipart podría bloquearse. Esto fue abordado en el archivo epan/disactors/packet-multipart.c corrigiendo la desasignación de partes MIME no válidas • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html https://gitlab.com/wireshark/wireshark/-/commit/5803c7b87b3414cdb8bf502af50bb406ca774482 https://gitlab.com/wireshark/wireshark/-/issues/16741 https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW https://lists.fedoraproject.org/archives&# •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 1CVE-2020-25866
https://notcve.org/view.php?id=CVE-2020-25866
In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncompressed) messages. This was addressed in epan/dissectors/packet-blip.c by allowing reasonable compression ratios and rejecting ZIP bombs. En Wireshark versiones 3.2.0 hasta 3.2.6 y versiones 3.0.0 hasta 3.0.13, el disector del protocolo BLIP presenta una desreferencia del puntero NULL porque un búfer fue dimensionado para mensajes comprimidos (no sin comprimir). Esto fue abordado en el archivo epan/disactors/packet-blip.c permitiendo relaciones de compresión razonables y rechazando las bombas ZIP • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html https://gitlab.com/wireshark/wireshark/-/commit/4a948427100b6c109f4ec7b4361f0d2aec5e5c3f https://gitlab.com/wireshark/wireshark/-/issues/16866 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IGRYKW4XLR44YDWTAH547ODYYBYPB2D&# • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 1CVE-2020-25862
https://notcve.org/view.php?id=CVE-2020-25862
In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changing the handling of the invalid 0xFFFF checksum. En Wireshark versiones 3.2.0 hasta 3.2.6, versiones 3.0.0 hasta 3.0.13 y versiones 2.6.0 hasta 2.6.20, el disector TCP podría bloquearse. Esto fue abordado en el archivo epan/disactors/packet-tcp.c mediante el cambio en el manejo del checksum 0xFFFF no válido • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html https://gitlab.com/wireshark/wireshark/-/commit/7f3fe6164a68b76d9988c4253b24d43f498f1753 https://gitlab.com/wireshark/wireshark/-/issues/16816 https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DQHPKZFQ7W3X34RYN3FWFYCFJD4FXJW https://lists.fedoraproject.org/archives&# • CWE-354: Improper Validation of Integrity Check Value •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2020-17498
https://notcve.org/view.php?id=CVE-2020-17498
In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during LZ4 decompression. En Wireshark versiones 3.2.0 hasta 3.2.5, el disector del protocolo Kafka podría bloquearse. Esto fue abordado en el archivo epan/dissectors/packet-kafka.c evitando una doble liberación durante la descompresión de LZ4 • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00038.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16672 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=76afda963de4f0b9be24f2d8e873990a5cbf221b https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AII7UYDPNKYE75AZL45M6HAV2COP7F6S https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa • CWE-415: Double Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15466
https://notcve.org/view.php?id=CVE-2020-15466
In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations. En Wireshark versiones 3.2.0 hasta 3.2.4, el disector GVCP podría entrar en un bucle infinito. Esto se abordó en el archivo epan/disectors/packet-gvcp.c asegurando que aumente la compensación en todas las situaciones • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00038.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16029 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=11f40896b696e4e8c7f8b2ad96028404a83a51a4 https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://security.gentoo.org/glsa/202007-13 https://www.wireshark.org/security/wnpa-sec-2020-09.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •