In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex
    Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote
    attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a
    crafted PDF document. (CVE-2018-10194)

  - In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in
    epan/dissectors/packet-lwapp.c by limiting the encapsulation levels to restrict the recursion depth.
    (CVE-2018-9256)

  - In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into an infinite loop. This was addressed in
    epan/dissectors/packet-cql.c by checking for a nonzero number of columns. (CVE-2018-9257)

  - In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-
    tcp.c by preserving valid data sources. (CVE-2018-9258)

  - In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was
    addressed in epan/dissectors/packet-ieee802154.c by ensuring that an allocation step occurs.
    (CVE-2018-9260)

Several issues that could result in a crash within different dissectors have been fixed. Other issues are related to memory leaks or heap-based buffer overflows.

All issue could be caused by special crafted and malformed packets.

For Debian 7 'Wheezy', these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u6~deb7u11.

We recommend that you upgrade your wireshark packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Wireshark installed on the remote MacOS/MacOSX host is 2.2.x prior to 2.2.14 or 2.4.x prior to 2.4.6. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Type	Severity
427108	Alpine: multiple wireshark packages, tshark: security update to 2.4.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
427108	Alpine: multiple wireshark packages, tshark: security update to 2.4.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
407622	Alpine: multiple wireshark packages, tshark: security update to 2.2.14-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
407622	Alpine: multiple wireshark packages, tshark: security update to 2.2.14-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
110164	Debian DLA-1388-1 : wireshark security update	Nessus	Debian Local Security Checks	Local	high
108884	Wireshark 2.2.x < 2.2.14 / 2.4.x < 2.4.6 Multiple Vulnerabilities (MacOS)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2018-9258

high

Tenable Plugins

high

high

high

high

high

high