The installed version of Wireshark 1.6 is earlier than 1.6.14.  It is, therefore, affected by the following vulnerabilities :

  - Errors exist in the FCSP, AMPQ, SCTP, and sFlow     dissector that could lead to an infinite loop resulting     in a denial of service. (Bugs 7789, 7802, 8337, 8359)

  - Errors exist in the CIMD, DTLS, Mount, MS-MMS, RTPS,     and RTPS2 that could allow them to crash.
    (Bugs 8382, 8332, 8335, 8346, 8380)

  - The ACN dissector can attempt a divide by zero     operation that could lead to an application crash.
    (Bug 8340)

wireshark has been updated to 1.8.6 which fixes bugs and security issues :

Vulnerabilities fixed :

  - The TCP dissector could crash. wnpa-sec-2013-10.
    (CVE-2013-2475)

  - The HART/IP dissectory could go into an infinite loop.
    wnpa-sec-2013-11. (CVE-2013-2476)

  - The CSN.1 dissector could crash. wnpa-sec-2013-12.
    (CVE-2013-2477)

  - The MS-MMS dissector could crash. wnpa-sec-2013-13.
    (CVE-2013-2478)

  - The MPLS Echo dissector could go into an infinite loop.
    wnpa-sec-2013-14. (CVE-2013-2479)

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15. (CVE-2013-2480)

  - The Mount dissector could crash. wnpa-sec-2013-16.
    (CVE-2013-2481)

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17. (CVE-2013-2482)

  - The ACN dissector could attempt to divide by zero.
    wnpa-sec-2013-18. (CVE-2013-2483)

  - The CIMD dissector could crash. wnpa-sec-2013-19.
    (CVE-2013-2484)

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20. (CVE-2013-2485)

  - The RELOAD dissector could go into an infinite loop.
    wnpa-sec-2013-21. (CVE-2013-2486 / CVE-2013-2487)

  - The DTLS dissector could crash. wnpa-sec-2013-22     (CVE-2013-2488) More information about further bug fixes     and updated protocol support are listed here:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.h     tml

wireshark has been updated to 1.6.14 to fix bugs and security issues :

Vulnerabilities fixed :

  - The sFlow dissector could go into an infinite loop.
    wnpa-sec-2012-32 CVE-2012-6054: * The SCTP dissector     could go into an infinite loop. wnpa-sec-2012-33     CVE-2012-6056: * The MS-MMS dissector could crash.
    wnpa-sec-2013-13 CVE-2013-2478

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15 CVE-2013-2480: * The Mount dissector     could crash. wnpa-sec-2013-16 CVE-2013-2481

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17 CVE-2013-2482: * The ACN dissector     could attempt to divide by zero. wnpa-sec-2013-18     CVE-2013-2483: * The CIMD dissector could crash.
    wnpa-sec-2013-19 CVE-2013-2484

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20 CVE-2013-2485: * The DTLS dissector     could crash. wnpa-sec-2013-22 CVE-2013-2488

Further bug fixes and updated protocol support are listed in :

http://www.wireshark.org/docs/relnotes/wireshark-1.6.14.html

The installed version of Wireshark 1.8 is earlier than 1.8.6.  It is, therefore, affected by the following vulnerabilities :

  - Errors exist in the CSN.1, CIMD, DTLS, Mount, MS-MMS,     RTPS, RTPS2, and TCP dissectors that could allow them     to crash. (Bugs 8274, 8332, 8335, 8346, 8380, 8382)

  - Errors exist in the AMPQ, FCSP, HART/IP, MPLS Echo,     and RELOAD dissectors that could lead to an infinite     loop, resulting in a denial of service. (Bugs 8039,     8337, 8359, 8360, 8364)

  - The ACN dissector can attempt a divide by zero     operation that could lead to an application crash.
    (Bug 8340)

Multiple vulnerabilities were discovered in the dissectors for the MS-MMS, RTPS, RTPS2, Mount, ACN, CIMD and DTLS protocols, which could result in denial of service or the execution of arbitrary code.

wireshark was updated to 1.8.6 [bnc#807942]

  + vulnerabilities fixed :

  - The TCP dissector could crash. wnpa-sec-2013-10     CVE-2013-2475

  - The HART/IP dissectory could go into an infinite loop.
    wnpa-sec-2013-11 CVE-2013-2476

  - The CSN.1 dissector could crash. wnpa-sec-2013-12     CVE-2013-2477

  - The MS-MMS dissector could crash. wnpa-sec-2013-13     CVE-2013-2478

  - The MPLS Echo dissector could go into an infinite loop.
    wnpa-sec-2013-14 CVE-2013-2479

  - The RTPS and RTPS2 dissectors could crash.
    wnpa-sec-2013-15 CVE-2013-2480

  - The Mount dissector could crash. wnpa-sec-2013-16     CVE-2013-2481

  - The AMPQ dissector could go into an infinite loop.
    wnpa-sec-2013-17 CVE-2013-2482

  - The ACN dissector could attempt to divide by zero.
    wnpa-sec-2013-18 CVE-2013-2483

  - The CIMD dissector could crash. wnpa-sec-2013-19     CVE-2013-2484

  - The FCSP dissector could go into an infinite loop.
    wnpa-sec-2013-20 CVE-2013-2485

  - The RELOAD dissector could go into an infinite loop.
    wnpa-sec-2013-21 CVE-2013-2486 CVE-2013-2487

  - The DTLS dissector could crash. wnpa-sec-2013-22     CVE-2013-2488 

  + Further bug fixes and updated protocol support as listed     in:
    http://www.wireshark.org/docs/relnotes/wireshark-1.8.6.h     tml

Multiple vulnerabilities has been found and corrected in wireshark :

Infinite and large loops in ANSI MAP, BACapp, Bluetooth HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed. Discovered by Laurent Butti (http://www.wireshark.org/security/wnpa-sec-2012-08.html [CVE-2012-2392])

The DIAMETER dissector could try to allocate memory improperly and crash (http://www.wireshark.org/security/wnpa-sec-2012-09.html [CVE-2012-2393])

Wireshark could crash on SPARC processors due to misaligned memory.
Discovered by Klaus Heckelmann (http://www.wireshark.org/security/wnpa-sec-2012-10.html [CVE-2012-2394])

The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump (CVE-2012-4048).

epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet (CVE-2012-4049).

The DCP ETSI dissector could trigger a zero division (CVE-2012-4285).

The XTP dissector could go into an infinite loop (CVE-2012-4288).

The AFP dissector could go into a large loop (CVE-2012-4289).

The RTPS2 dissector could overflow a buffer (CVE-2012-4296).

The GSM RLC MAC dissector could overflow a buffer (CVE-2012-4297).

The CIP dissector could exhaust system memory (CVE-2012-4291).

The STUN dissector could crash (CVE-2012-4292).

The EtherCAT Mailbox dissector could abort (CVE-2012-4293).

The CTDB dissector could go into a large loop (CVE-2012-4290).

Martin Wilck discovered an infinite loop in the DRDA dissector (CVE-2012-5239).

The USB dissector could go into an infinite loop. (wnpa-sec-2012-31)

The ISAKMP dissector could crash. (wnpa-sec-2012-35)

The iSCSI dissector could go into an infinite loop. (wnpa-sec-2012-36)

The WTP dissector could go into an infinite loop. (wnpa-sec-2012-37)

The RTCP dissector could go into an infinite loop. (wnpa-sec-2012-38)

The ICMPv6 dissector could go into an infinite loop.
(wnpa-sec-2012-40)

Infinite and large loops in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors (wnpa-sec-2013-01).

The CLNP dissector could crash (wnpa-sec-2013-02).

The DTN dissector could crash (wnpa-sec-2013-03).

The MS-MMC dissector (and possibly others) could crash (wnpa-sec-2013-04).

The DTLS dissector could crash (wnpa-sec-2013-05).

The DCP-ETSI dissector could corrupt memory (wnpa-sec-2013-07).

The Wireshark dissection engine could crash (wnpa-sec-2013-08).

The NTLMSSP dissector could overflow a buffer (wnpa-sec-2013-09).

The sFlow dissector could go into an infinite loop (CVE-2012-6054).

The SCTP dissector could go into an infinite loop (CVE-2012-6056).

The MS-MMS dissector could crash (CVE-2013-2478).

The RTPS and RTPS2 dissectors could crash (CVE-2013-2480).

The Mount dissector could crash (CVE-2013-2481).

The AMPQ dissector could go into an infinite loop (CVE-2013-2482).

The ACN dissector could attempt to divide by zero (CVE-2013-2483).

The CIMD dissector could crash (CVE-2013-2484).

The FCSP dissector could go into an infinite loop (CVE-2013-2485).

The DTLS dissector could crash (CVE-2013-2488).

This advisory provides the latest version of Wireshark (1.6.14) which is not vulnerable to these issues.

ID	Name	Product	Family	Published	Updated	Severity
65253	Wireshark 1.6.x < 1.6.14 Multiple Vulnerabilities	Nessus	Windows	3/13/2013	3/9/2023	medium
66254	SuSE 11.2 Security Update : wireshark (SAT Patch Number 7490)	Nessus	SuSE Local Security Checks	4/29/2013	1/19/2021	high
66255	SuSE 10 Security Update : wireshark (ZYPP Patch Number 8500)	Nessus	SuSE Local Security Checks	4/29/2013	1/19/2021	high
65254	Wireshark 1.8.x < 1.8.6 Multiple Vulnerabilities	Nessus	Windows	3/13/2013	3/9/2023	high
65557	Debian DSA-2644-1 : wireshark - several vulnerabilities	Nessus	Debian Local Security Checks	3/15/2013	1/11/2021	medium
74930	openSUSE Security Update : wireshark (openSUSE-SU-2013:0494-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high
66069	Mandriva Linux Security Advisory : wireshark (MDVSA-2013:055)	Nessus	Mandriva Local Security Checks	4/20/2013	1/6/2021	high

Detections

Analytics

Plugins Search

medium

high

high

high

medium

high

high