Wireshark: Denial of service — GLSA 202008-14

A vulnerability in Wireshark could lead to a Denial of Service condition.

Affected packages

net-analyzer/wireshark on all architectures
Affected versions < 3.2.6
Unaffected versions >= 3.2.6

Background

Wireshark is a network protocol analyzer formerly known as ethereal.

Description

A double free error was discovered in Wireshark’s Kafka dissector.

Impact

A remote attacker could exploit these vulnerabilities by sending a malformed packet or enticing a user to read a malformed packet trace file, causing a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Wireshark users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-3.2.6"
 

References

Release date
August 26, 2020

Latest revision
August 26, 2020: 1

Severity
normal

Exploitable
local, remote

Bugzilla entries