[ MDVSA-2009:058 ] wireshark

[dude67]

_______________________________________________________________________

Package : wireshark
Date : February 26, 2009
Affected: 2008.1, 2009.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through
1.0.5 allows user-assisted remote attackers to cause a denial
of service (application crash) via a malformed NetScreen snoop
file. (CVE-2009-0599)

Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to
cause a denial of service (application crash) via a crafted Tektronix
K12 text capture file, as demonstrated by a file with exactly one
frame. (CVE-2009-0600)

Format string vulnerability in Wireshark 0.99.8 through 1.0.5
on non-Windows platforms allows local users to cause a denial of
service (application crash) via format string specifiers in the HOME
environment variable. (CVE-2009-0601)

This update provides Wireshark 1.0.6, which is not vulnerable to
these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0599
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0600
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0601
http://www.wireshark.org/security/wnpa-sec-2009-01.html
_______________________________________________________________________