CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 1CVE-2020-9431
https://notcve.org/view.php?id=CVE-2020-9431
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations. En Wireshark versiones 3.2.0 hasta 3.2.1, versiones 3.0.0 hasta 3.0.8 y versiones 2.6.0 hasta 2.6.14, el disector LTE RRC podría perder memoria. Esto se abordó en el archivo epan/disectors/packet-lte-rrc.c mediante el ajuste de determinadas operaciones de adición. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16341 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=086003c9d616906e08bbeeab9c17b3aa4c6ff850 https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZBICEY2HGSNQ3RPBLMDDYVAHGOGS4E2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-7045
https://notcve.org/view.php?id=CVE-2020-7045
In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by validating opcodes. En Wireshark versiones 3.0.x anteriores a la versión 3.0.8, el disector BT ATT podría bloquearse. Esto fue abordado en el archivo epan/dissectors/packet-btatt.c mediante la comprobación de códigos de operación. • https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16258 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=01f261de41f4dd3233ef578e5c0ffb9c25c7d14d https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://www.wireshark.org/security/wnpa-sec-2020-02.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-19553
https://notcve.org/view.php?id=CVE-2019-19553
In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection. En Wireshark versiones 3.0.0 hasta 3.0.6 y versiones 2.6.0 hasta 2.6.12, el disector de CMS se podría bloquear. Esto fue abordado en el archivo epan/dissectors/asn1/cms/packet-cms-template.c asegurándose de que un identificador de objeto sea establecido en NULL después de una disección de ContentInfo. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15961 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=34d2e0d5318d0a7e9889498c721639e5cbf4ce45 https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://www.oracle.com/security-alerts/cpuapr2020.html https://www.wireshark.org/security/wnpa-sec-2019-22.html • CWE-909: Missing Initialization of Resource •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16319
https://notcve.org/view.php?id=CVE-2019-16319
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero. En Wireshark versiones 3.0.0 hasta 3.0.3 y versiones 2.6.0 hasta 2.6.10, el disector Gryphon podría entrar en un bucle infinito. Esto fue abordado en el archivo plugins/epan/gryphon/packet-gryphon.c mediante la comprobación de la longitud de un mensaje de cero. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16020 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=02ddd49885c6a09e936a76aceb726ed06539704a https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://www.wireshark.org/security/wnpa-sec-2019-21.html • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 1CVE-2019-13619
https://notcve.org/view.php?id=CVE-2019-13619
In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c by properly restricting buffer increments. En Wireshark versiones 3.0.0 hasta 3.0.2, versiones 2.6.0 hasta 2.6.9 y versiones 2.4.0 hasta 2.4.15, el disector ASN.1 BER y los disectores relacionados podrían bloquearse. Esto se abordó en el archivo epan/asn1.c mediante la restricción apropiada de los incrementos del búfer. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html http://www.securityfocus.com/bid/109293 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15870 https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7e90aed666e809c0db5de9d1816802a7dcea28d9 https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •