Bug 998963 (CVE-2016-7179) - VUL-0: CVE-2016-7179: wireshark: Catapult DCT2000 dissector crash
Summary: VUL-0: CVE-2016-7179: wireshark: Catapult DCT2000 dissector crash
Status: RESOLVED FIXED
Alias: CVE-2016-7179
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Lingshan Zhu
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/172502/
Whiteboard: CVSSv2:RedHat:CVE-2016-7179:4.3:(AV:N...
Keywords:
Depends on: 998099
Blocks:
  Show dependency tree / graph
 
Reported: 2016-09-15 07:41 UTC by Victor Pereira
Modified: 2018-10-13 16:01 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2016-09-15 07:41:01 UTC 
rh#1375118

It was reported that Wireshark's Catapult DCT2000 dissector could crash. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Upstream bug(s):

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12752



References:
https://www.wireshark.org/security/wnpa-sec-2016-54.html
https://bugzilla.redhat.com/show_bug.cgi?id=1375118
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7179
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7179.html
http://www.cvedetails.com/cve/CVE-2016-7179/
Comment 1 Swamp Workflow Management 2016-09-15 22:00:23 UTC 
bugbot adjusting priority
Comment 2 Lingshan Zhu 2016-11-01 03:28:12 UTC 
Since we need to update to 2.x version, there is a new fate created for this bug, see https://fate.suse.com/321770
Comment 3 Lingshan Zhu 2016-11-21 08:26:00 UTC 
a new version wireshark 2.2.2 can build for SLE12, but whether update to 2.2.2 depends on fate#321770, see https://fate.suse.com/321770
Comment 4 Lingshan Zhu 2017-05-02 02:41:32 UTC 
resolved by the latest update
Comment 5 Swamp Workflow Management 2017-05-04 13:13:29 UTC 
SUSE-SU-2017:1174-1: An update that solves 23 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1002981,1010735,1010740,1010752,1010754,1010911,1021739,1025913,1027998,1033936,1033937,1033938,1033939,1033940,1033941,1033942,1033943,1033944,1033945,998761,998762,998763,998800,998963,998964
CVE References: CVE-2016-7175,CVE-2016-7176,CVE-2016-7177,CVE-2016-7178,CVE-2016-7179,CVE-2016-7180,CVE-2016-9373,CVE-2016-9374,CVE-2016-9375,CVE-2016-9376,CVE-2017-5596,CVE-2017-5597,CVE-2017-6014,CVE-2017-7700,CVE-2017-7701,CVE-2017-7702,CVE-2017-7703,CVE-2017-7704,CVE-2017-7705,CVE-2017-7745,CVE-2017-7746,CVE-2017-7747,CVE-2017-7748
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    wireshark-2.0.12-36.1
SUSE Linux Enterprise Server 11-SP4 (src):    wireshark-2.0.12-36.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    wireshark-2.0.12-36.1
Comment 6 Swamp Workflow Management 2017-05-30 16:14:01 UTC 
SUSE-SU-2017:1442-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1002981,1010735,1010740,1010752,1010754,1010911,1021739,1025913,1026507,1027692,1027998,1033936,1033937,1033938,1033939,1033940,1033941,1033942,1033943,1033944,1033945,990856,998761,998762,998763,998800,998963,998964
CVE References: CVE-2016-6354,CVE-2016-7175,CVE-2016-7176,CVE-2016-7177,CVE-2016-7178,CVE-2016-7179,CVE-2016-7180,CVE-2016-9373,CVE-2016-9374,CVE-2016-9375,CVE-2016-9376,CVE-2017-5596,CVE-2017-5597,CVE-2017-6014,CVE-2017-7700,CVE-2017-7701,CVE-2017-7702,CVE-2017-7703,CVE-2017-7704,CVE-2017-7705,CVE-2017-7745,CVE-2017-7746,CVE-2017-7747,CVE-2017-7748
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Server 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Server 12-SP1 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Desktop 12-SP2 (src):    wireshark-2.2.6-44.3
SUSE Linux Enterprise Desktop 12-SP1 (src):    wireshark-2.2.6-44.3
Comment 7 Swamp Workflow Management 2018-10-13 16:01:44 UTC 
This is an autogenerated message for OBS integration:
This bug (998963) was mentioned in
https://build.opensuse.org/request/show/641836 42.3 / wireshark