Debian Long Term Support / LTS Security Information / 2021 / Security Information -- DLA-2849-1 wireshark

Debian Security Advisory

DLA-2849-1 wireshark -- LTS security update

Date Reported:

26 Dec 2021

Affected Packages:

wireshark

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 987853.
In Mitre's CVE dictionary: CVE-2021-22207, CVE-2021-22235, CVE-2021-39921, CVE-2021-39922, CVE-2021-39923, CVE-2021-39924, CVE-2021-39925, CVE-2021-39928, CVE-2021-39929.

More information:

Several vulnerabilities were fixed in the network traffic analyzer Wireshark.

• CVE-2021-22207

  Excessive memory consumption in the MS-WSP dissector.

• CVE-2021-22235

  Crash in the DNP dissector.

• CVE-2021-39921

  NULL pointer exception in the Modbus dissector.

• CVE-2021-39922

  Buffer overflow in the C12.22 dissector.

• CVE-2021-39923

  Large loop in the PNRP dissector.

• CVE-2021-39924

  Large loop in the Bluetooth DHT dissector.

• CVE-2021-39925

  Buffer overflow in the Bluetooth SDP dissector.

• CVE-2021-39928

  NULL pointer exception in the IEEE 802.11 dissector.

• CVE-2021-39929

  Uncontrolled Recursion in the Bluetooth DHT dissector.

For Debian 9 stretch, these problems have been fixed in version 2.6.20-0+deb9u2.

We recommend that you upgrade your wireshark packages.

For the detailed security status of wireshark please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wireshark

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS