ALAS2023-2023-038: Security update for 4 packages

ALAS2023-2023-038, released February 17, 2023, fixes 22 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0814

94th percentile

Priority of the 22 CVEs

Patch now 0
                                Urgent 1
                                High 19
                                Routine 2

Fixed package versions

Product	Release	Fixed in
wireshark-cli	amzn 2023	1:4.0.2-1.amzn2023.0.2
wireshark-cli-debuginfo	amzn 2023	1:4.0.2-1.amzn2023.0.2
wireshark-debugsource	amzn 2023	1:4.0.2-1.amzn2023.0.2
wireshark-devel	amzn 2023	1:4.0.2-1.amzn2023.0.2

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2022-0582	wireshark: Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of ser...	9.8	0.0199	None reported
High	CVE-2021-39925	wireshark: Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of servi...	7.5	0.0814	None reported
High	CVE-2021-39926	wireshark: Buffer overflow in the Bluetooth HCI_ISO dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet in...	7.5	0.0796	None reported
High	CVE-2021-39928	wireshark: NULL pointer exception in the IEEE 802.11 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of...	7.5	0.0591	None reported
High	CVE-2021-39922	wireshark: Buffer overflow in the C12.22 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via...	7.5	0.0556	None reported
High	CVE-2021-39924	wireshark: Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service vi...	7.5	0.0529	None reported
High	CVE-2021-4181	wireshark: wireshark - security update	7.5	0.0406	None reported
High	CVE-2021-4184	wireshark: Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via pac...	7.5	0.0406	None reported
High	CVE-2021-4185	wireshark: Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injec...	7.5	0.0406	None reported
High	CVE-2021-39929	wireshark: Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial o...	7.5	0.0381	None reported
High	CVE-2021-4182	wireshark: Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection...	7.5	0.0345	None reported
High	CVE-2021-39921	wireshark: NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of servi...	7.5	0.0337	None reported
High	CVE-2021-4190	wireshark: Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture...	7.5	0.0333	None reported
High	CVE-2021-39920	wireshark: NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet inject...	7.5	0.0329	None reported
High	CVE-2021-4186	wireshark: Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted...	7.5	0.0231	None reported
High	CVE-2022-0586	wireshark: Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service vi...	7.5	0.0200	None reported
High	CVE-2022-0581	wireshark: Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via pack...	7.5	0.0179	None reported
High	CVE-2022-0583	wireshark: Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via pac...	7.5	0.0179	None reported
High	CVE-2021-39923	wireshark: Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet...	7.5	0.0161	None reported
High	CVE-2022-3725	wireshark: Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or cra...	7.5	0.0107	None reported
Routine	CVE-2022-0585	wireshark: Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service v...	6.5	0.0239	None reported
Routine	CVE-2022-3190	wireshark: The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a comput...	5.5	0.0230	None reported

Also fixes CVE-2022-0582

libwireshark-data 2.6.10-1~ubuntu18.04.0+esm2
libwireshark-data on Ubuntu 18.04.6 LTS (bionic)
libwireshark11 2.6.10-1~ubuntu18.04.0+esm2
libwireshark11 on Ubuntu 18.04.6 LTS (bionic)
libwiretap8 2.6.10-1~ubuntu18.04.0+esm2
libwiretap8 on Ubuntu 18.04.6 LTS (bionic)
libwscodecs2 2.6.10-1~ubuntu18.04.0+esm2
libwscodecs2 on Ubuntu 18.04.6 LTS (bionic)
libwsutil9 2.6.10-1~ubuntu18.04.0+esm2
libwsutil9 on Ubuntu 18.04.6 LTS (bionic)
tshark 2.6.10-1~ubuntu18.04.0+esm2
tshark on Ubuntu 18.04.6 LTS (bionic)
wireshark 2.6.10-1~ubuntu18.04.0+esm2
wireshark on Ubuntu 18.04.6 LTS (bionic)
wireshark-common 2.6.10-1~ubuntu18.04.0+esm2
wireshark-common on Ubuntu 18.04.6 LTS (bionic)

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2023-038.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2023-038">ALAS2023-2023-038 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.