[USN-6262-1] Wireshark vulnerabilities

[David Fernandez Gonzalez]

==========================================================================
Ubuntu Security Notice USN-6262-1
July 31, 2023

wireshark vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in Wireshark.

Software Description:
- wireshark: network traffic analyzer - meta-package

Details:

It was discovered that Wireshark did not properly handle certain
NFS packages when certain configuration options were enabled.
An attacker could possibly use this issue to cause
Wireshark to crash, resulting in a denial of service. (CVE-2020-13164)

It was discovered that Wireshark did not properly handle certain GVCP
packages. An attacker could possibly use this issue to cause
Wireshark to crash, resulting in a denial of service. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-15466)

It was discovered that Wireshark did not properly handle certain
Kafka packages. An attacker could possibly use this issue to cause
Wireshark to crash, resulting in a denial of service. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-17498)

It was discovered that Wireshark did not properly handle certain TCP
packages containing an invalid 0xFFFF checksum. An attacker could
possibly use this issue to cause Wireshark to crash, resulting in
a denial of service. (CVE-2020-25862)

It was discovered that Wireshark did not properly handle certain
MIME packages containing invalid parts. An attacker could
possibly use this issue to cause Wireshark to crash, resulting in
a denial of service. (CVE-2020-25863)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
   libwireshark13                  3.2.3-1ubuntu0.1~esm1
   tshark                          3.2.3-1ubuntu0.1~esm1
   wireshark                       3.2.3-1ubuntu0.1~esm1
   wireshark-common                3.2.3-1ubuntu0.1~esm1
   wireshark-gtk                   3.2.3-1ubuntu0.1~esm1
   wireshark-qt                    3.2.3-1ubuntu0.1~esm1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   libwireshark11                  2.6.10-1~ubuntu18.04.0+esm1
   tshark                          2.6.10-1~ubuntu18.04.0+esm1
   wireshark                       2.6.10-1~ubuntu18.04.0+esm1
   wireshark-common                2.6.10-1~ubuntu18.04.0+esm1
   wireshark-gtk                   2.6.10-1~ubuntu18.04.0+esm1
   wireshark-qt                    2.6.10-1~ubuntu18.04.0+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   libwireshark11                  2.6.10-1~ubuntu16.04.0+esm1
   tshark                          2.6.10-1~ubuntu16.04.0+esm1
   wireshark                       2.6.10-1~ubuntu16.04.0+esm1
   wireshark-common                2.6.10-1~ubuntu16.04.0+esm1
   wireshark-gtk                   2.6.10-1~ubuntu16.04.0+esm1
   wireshark-qt                    2.6.10-1~ubuntu16.04.0+esm1

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
   libwireshark11                  2.6.10-1~ubuntu14.04.0~esm2
   tshark                          2.6.10-1~ubuntu14.04.0~esm2
   wireshark                       2.6.10-1~ubuntu14.04.0~esm2
   wireshark-common                2.6.10-1~ubuntu14.04.0~esm2
   wireshark-gtk                   2.6.10-1~ubuntu14.04.0~esm2
   wireshark-qt                    2.6.10-1~ubuntu14.04.0~esm2

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6262-1
   CVE-2020-13164, CVE-2020-15466, CVE-2020-17498, CVE-2020-25862,
   CVE-2020-25863

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230731/04bae329/attachment.sig>