Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.0028
wireshark security update
4 January 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: wireshark
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-39929 CVE-2021-39928 CVE-2021-39925
CVE-2021-39924 CVE-2021-39923 CVE-2021-39922
CVE-2021-39921 CVE-2021-22235 CVE-2021-22207
Reference: ESB-2021.4193
Original Bulletin:
http://www.debian.org/lts/security/2021/dla-2849
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2849-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
December 26, 2021 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : wireshark
Version : 2.6.20-0+deb9u2
CVE ID : CVE-2021-22207 CVE-2021-22235 CVE-2021-39921 CVE-2021-39922
CVE-2021-39923 CVE-2021-39924 CVE-2021-39925 CVE-2021-39928
CVE-2021-39929
Debian Bug : 987853
Several vulnerabilities were fixed in the network traffic analyzer Wireshark.
CVE-2021-22207
Excessive memory consumption in the MS-WSP dissector.
CVE-2021-22235
Crash in the DNP dissector.
CVE-2021-39921
NULL pointer exception in the Modbus dissector.
CVE-2021-39922
Buffer overflow in the C12.22 dissector.
CVE-2021-39923
Large loop in the PNRP dissector.
CVE-2021-39924
Large loop in the Bluetooth DHT dissector.
CVE-2021-39925
Buffer overflow in the Bluetooth SDP dissector.
CVE-2021-39928
NULL pointer exception in the IEEE 802.11 dissector.
CVE-2021-39929
Uncontrolled Recursion in the Bluetooth DHT dissector.
For Debian 9 stretch, these problems have been fixed in version
2.6.20-0+deb9u2.
We recommend that you upgrade your wireshark packages.
For the detailed security status of wireshark please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/wireshark
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmHIwmAACgkQiNJCh6LY
mLHgMg/+Kd1wRS3kNX5Qxvf3Zi/+kAWLOcLGeTzsuXG6Gxvokyh957PV6TiCe+N2
J3m1h0oZQECWrPf/4l/m2I3adA6P7xlOX2ozO5PbtRPju1+FmqY8fs4mEDEgrR5d
z608Cvyl32Y+vffze9/rpSK6UzLzW7QnKX5SKRNt6q03q2pnAOjT7ED79AAZXPL0
b3mTHQsiAQO93t+6D0dXf8oUjZ/FFM2anTDPbRcGQu5f32pFv+KCLWEMDUwdA8Nx
iVbVk/FL+tMKtd/kABUFwa3gpYDbm/1fH9kHFEamElOsv+R9qFzITgnZr+tKRb6P
1AP8FJhLwcNMSk8FXK7BEIOIfxOTh3I/9eC4KLOznKIfGqPYSrQmFJIqJ/l5xyej
PXyo/Ygf58OQbeLSZkOiTlq5yhJmxOj/G81sDx0VxBgnt6JStBo3Vhqlz2Tj0nYp
WuOLFUW+k74NpG0rtfFU8hJjdrKzvvqGhS6XBmDuH9RThKwi/xyPEhZI+DQxL06n
l1qaJ1tfGiOS0mLWP+ZU8cOLdmc2jiQvdOdAe9onFyQPkJ8Knsa+ik+OuVC3VMXK
X0NwdVPpb+p5DcIV4cE8yei0YXZ2CZDugA8s4I92HwIQ/Gn6tYq1lmYpG44pigGI
i6ZJczH9UYzOXpJIiHlqg6OsorE0mJxynLbWdYo0lXnbqNOWcAk=
=b+J5
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYdPT8uNLKJtyKPYoAQi66g/7Buq/kCQcjq7e5D+rR3edBTxXr/jOVjhN
XPFRQnzxmuKKOTfKSehv0qJBlIn2hD9FtCux6G3GPp1nEEiRFyIl0BY/LH3cxnIU
5g5542CpqgrAYuw88zmWXGk8g3O5iLZwu9xb+62qCF9V3XUN0k7GrmbkL6Cbr+XU
5hp7jrMMRM+g1nBiOsQYUtQhkc79wzUgk6UViMUCSS6skxWMvr3vBt43jGpN+AlJ
2r51n04mJk4JVE/Xe48hFUK/87cUmYIZ56SrgkOzoTDlHL12lNAo9qGQh93J03qM
k+/jDKy9mIOXt2/DWDGnCiQOWGCNSW7xqIuhxxELHXTeQFDoa7dEUpQrCrcWZai/
nqJnRV8pqpa524xfQQLi5dU6CUIvoWb8GO1mvK41qezUHmGyipJeIFroxACHeukC
ImHFXa5MtU/y3nasdJ1C8BT8ZdGeQ8bWw2pj/MUZG9AHFpkAXmC3QBQG0YTNl2J8
b8I4UWBkc0vCSJthwDCsfcGJWdu44Vh79MtrXRQWnpGiBxfSPqt/TjvuOpvOdqct
S4OdenXOQHgWRWUWDLDM9TqTQTs8Y6pIs58HIW/M58NLIv1Hsq2LyqtQzoiQsqCr
YnWvM8fkO74R6nleOU/jXzNPsrWUrpif+TxVnRJLYpQz/WfAtZIRO3JS/+0UZHND
EF6IH9BV4bQ=
=C0Th
-----END PGP SIGNATURE-----