SB2016092603 - Arch Linux update for wireshark-cli

Description

This security bulletin contains information about 6 vulnerabilities.

1) Denial of service (CVE-ID: CVE-2016-7175)

The vulnerability allows remote user to cause the denial of service on the target system.
The weakness exists due to causing of the QNX6 QNET dissector crash. A remote attacker can send and inject specially crafted malformed packet or trick the victim into reading its trace file.
Successful exploitation of this vulnerability will allow an attacker to cause a denial of service on the vulnerable system.

2) Denial of service (CVE-ID: CVE-2016-7176)

The vulnerability allows remote user to cause the denial of service on the target system.
The weakness exists due to causing of the H.225 dissector crash. A remote attacker can send and inject specially crafted malformed packet or trick the victim into reading its trace file.
Successful exploitation of this vulnerability will allow an attacker to cause a denial of service on the vulnerable system.

3) (CVE-ID: CVE-2016-7177)

The vulnerability allows remote user to cause the denial of service on the target system.
The weakness exists due to causing of the Catapult DCT2000 dissector crash. A remote attacker can send and inject specially crafted malformed packet or trick the victim into reading its trace file.
Successful exploitation of this vulnerability will allow an attacker to cause a denial of service on the vulnerable system.

4) Denial of service (CVE-ID: CVE-2016-7178)

The vulnerability allows remote user to cause the denial of service on the target system.
The weakness exists due to causing of the UMTS FP dissector crash. A remote attacker can send and inject specially crafted malformed packet or trick the victim into reading its trace file.
Successful exploitation of this vulnerability will allow an attacker to cause a denial of service on the vulnerable system.

5) Denial of service (CVE-ID: CVE-2016-7179)

The vulnerability allows remote user to cause the denial of service on the target system.
The weakness exists due to causing of the Catapult DCT2000 dissector crash. A remote attacker can send and inject specially crafted malformed packet or trick the victim into reading its trace file.
Successful exploitation of this vulnerability will allow an attacker to cause a denial of service on the vulnerable system.

6) Denial of service (CVE-ID: CVE-2016-7180)

The vulnerability allows remote user to cause the denial of service on the target system.
The weakness exists due to causing of the IPMI Trace dissector crash. A remote attacker can send and inject specially crafted malformed packet or trick the victim into reading its trace file.
Successful exploitation of this vulnerability will allow an attacker to cause a denial of service on the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://security.archlinux.org/advisory/ASA-201609-27