An update for wireshark is now available for openEuler-22.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1094 Final 1.0 1.0 2023-02-17 Initial 2023-02-17 2023-02-17 openEuler SA Tool V1.0 2023-02-17 wireshark security update An update for wireshark is now available for openEuler-22.03-LTS. Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.Wireshark, formerly known as Ethereal, can be used to examine the details of traffic at a variety of levels ranging from connection-level information to the bits that make up a single packet. Packet capture can provide a network administrator with information about individual packets such as transmit time, source, destination, protocol type and header data. This information can be useful for evaluating security events and troubleshooting network security device issues. Security Fix(es): Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows(CVE-2022-3724) Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file(CVE-2022-4344) Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file(CVE-2022-4345) Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0413) Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0417) iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0415) Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0411) TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0412) GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file(CVE-2023-0416) An update for wireshark is now available for openEuler-22.03-LTS. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High wireshark https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-3724 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-4344 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-4345 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0413 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0417 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0415 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0411 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0412 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-0416 https://nvd.nist.gov/vuln/detail/CVE-2022-3724 https://nvd.nist.gov/vuln/detail/CVE-2022-4344 https://nvd.nist.gov/vuln/detail/CVE-2022-4345 https://nvd.nist.gov/vuln/detail/CVE-2023-0413 https://nvd.nist.gov/vuln/detail/CVE-2023-0417 https://nvd.nist.gov/vuln/detail/CVE-2023-0415 https://nvd.nist.gov/vuln/detail/CVE-2023-0411 https://nvd.nist.gov/vuln/detail/CVE-2023-0412 https://nvd.nist.gov/vuln/detail/CVE-2023-0416 openEuler-22.03-LTS wireshark-help-3.6.11-1.oe2203.aarch64.rpm wireshark-debugsource-3.6.11-1.oe2203.aarch64.rpm wireshark-devel-3.6.11-1.oe2203.aarch64.rpm wireshark-debuginfo-3.6.11-1.oe2203.aarch64.rpm wireshark-3.6.11-1.oe2203.aarch64.rpm wireshark-3.6.11-1.oe2203.src.rpm wireshark-debuginfo-3.6.11-1.oe2203.x86_64.rpm wireshark-help-3.6.11-1.oe2203.x86_64.rpm wireshark-debugsource-3.6.11-1.oe2203.x86_64.rpm wireshark-devel-3.6.11-1.oe2203.x86_64.rpm wireshark-3.6.11-1.oe2203.x86_64.rpm Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows 2023-02-17 CVE-2022-3724 openEuler-22.03-LTS High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2022-4344 openEuler-22.03-LTS Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2022-4345 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2023-0413 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2023-0417 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2023-0415 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2023-0411 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2023-0412 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094 GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file 2023-02-17 CVE-2023-0416 openEuler-22.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H wireshark security update 2023-02-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1094