openSUSE-SU-2021:2125-1: important: Security update for wireshark
openSUSE Security Update: Security update for wireshark
______________________________________________________________________________
Announcement ID: openSUSE-SU-2021:2125-1
Rating: important
References: #1179930 #1179931 #1179932 #1179933 #1180102
#1180232 #1181598 #1181599 #1183353 #1184110
#1185128
Cross-References: CVE-2020-26418 CVE-2020-26419 CVE-2020-26420
CVE-2020-26421 CVE-2020-26422 CVE-2021-22173
CVE-2021-22174 CVE-2021-22191 CVE-2021-22207
CVSS scores:
CVE-2020-26418 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2020-26418 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2020-26419 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2020-26420 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2020-26420 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVE-2020-26421 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2020-26421 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2020-26422 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2020-26422 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2021-22173 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-22173 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2021-22174 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-22174 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2021-22191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2021-22191 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2021-22207 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-22207 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products:
openSUSE Leap 15.3
______________________________________________________________________________
An update that solves 9 vulnerabilities and has two fixes
is now available.
Description:
This update for wireshark, libvirt, sbc and libqt5-qtmultimedia fixes the
following issues:
Update wireshark to version 3.4.5
- New and updated support and bug fixes for multiple protocols
- Asynchronous DNS resolution is always enabled
- Protobuf fields can be dissected as Wireshark (header) fields
- UI improvements
Including security fixes for:
- CVE-2021-22191: Wireshark could open unsafe URLs (bsc#1183353).
- CVE-2021-22207: MS-WSP dissector excessive memory consumption
(bsc#1185128)
- CVE-2020-26422: QUIC dissector crash (bsc#1180232)
- CVE-2020-26418: Kafka dissector memory leak (bsc#1179930)
- CVE-2020-26419: Multiple dissector memory leaks (bsc#1179931)
- CVE-2020-26420: RTPS dissector memory leak (bsc#1179932)
- CVE-2020-26421: USB HID dissector crash (bsc#1179933)
- CVE-2021-22173: Fix USB HID dissector memory leak (bsc#1181598)
- CVE-2021-22174: Fix USB HID dissector crash (bsc#1181599)
libqt5-qtmultimedia and sbc are necessary dependencies. libvirt is needed
to rebuild wireshark-plugin-libvirt.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2021-2125=1
Package List:
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
libsbc1-1.3-3.2.1
libsbc1-debuginfo-1.3-3.2.1
libwireshark14-3.4.5-3.53.1
libwireshark14-debuginfo-3.4.5-3.53.1
libwiretap11-3.4.5-3.53.1
libwiretap11-debuginfo-3.4.5-3.53.1
libwsutil12-3.4.5-3.53.1
libwsutil12-debuginfo-3.4.5-3.53.1
sbc-1.3-3.2.1
sbc-debuginfo-1.3-3.2.1
sbc-debugsource-1.3-3.2.1
sbc-devel-1.3-3.2.1
wireshark-3.4.5-3.53.1
wireshark-debuginfo-3.4.5-3.53.1
wireshark-debugsource-3.4.5-3.53.1
wireshark-devel-3.4.5-3.53.1
wireshark-ui-qt-3.4.5-3.53.1
wireshark-ui-qt-debuginfo-3.4.5-3.53.1
- openSUSE Leap 15.3 (x86_64):
libsbc1-32bit-1.3-3.2.1
libsbc1-32bit-debuginfo-1.3-3.2.1
References:
https://www.suse.com/security/cve/CVE-2020-26418.html
https://www.suse.com/security/cve/CVE-2020-26419.html
https://www.suse.com/security/cve/CVE-2020-26420.html
https://www.suse.com/security/cve/CVE-2020-26421.html
https://www.suse.com/security/cve/CVE-2020-26422.html
https://www.suse.com/security/cve/CVE-2021-22173.html
https://www.suse.com/security/cve/CVE-2021-22174.html
https://www.suse.com/security/cve/CVE-2021-22191.html
https://www.suse.com/security/cve/CVE-2021-22207.html
https://bugzilla.suse.com/1179930
https://bugzilla.suse.com/1179931
https://bugzilla.suse.com/1179932
https://bugzilla.suse.com/1179933
https://bugzilla.suse.com/1180102
https://bugzilla.suse.com/1180232
https://bugzilla.suse.com/1181598
https://bugzilla.suse.com/1181599
https://bugzilla.suse.com/1183353
https://bugzilla.suse.com/1184110
https://bugzilla.suse.com/1185128
A wireshark security update has been released for openSUSE Leap 15.3.
