Alpine: tshark, multiple wireshark packages: security update to 2.2.4-r1 (deprecated)

high Tenable Self-Hosted Container Security Plugin ID 400887

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet
injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining
packet lateness. (CVE-2017-6470)

- In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered
by a malformed capture file. This was addressed in wiretap/netscaler.c by changing the restrictions on
file size. (CVE-2017-6467)

- In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a
malformed capture file. This was addressed in wiretap/netscaler.c by validating the relationship between
pages and records. (CVE-2017-6468)

- In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet
injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring
that memory is allocated for a certain data structure. (CVE-2017-6469)

Plugin Details

Severity: High

ID: 400887

Version: Revision 1.22

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 1/17/2024

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2017-6470

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2017-6474

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/17/2017

Vulnerability Publication Date: 3/3/2017

Reference Information

CVE: CVE-2017-6467, CVE-2017-6468, CVE-2017-6469, CVE-2017-6470, CVE-2017-6471, CVE-2017-6472, CVE-2017-6473, CVE-2017-6474

BID: 96561, 96563, 96564, 96565, 96566, 96569, 96571, 96577

IAVB: 2017-B-0027-S

Detections

Analytics