Wireshark 1.4.x and 1.6.x updates close security holes
Versions 1.4.11 and 1.6.5 of the open source Wireshark network protocol analyser have been released, fixing bugs and closing holes found in the previous builds. The maintenance and security updates to the cross-platform tool fix several vulnerabilities that could be exploited by an attacker to cause a denial-of-service (DoS) or compromise a victim's system.
The vulnerabilities include a NULL pointer deference error when displaying packet information, issues in the file parser that cause Wireshark to fail to properly check record sizes for a number of packet capture formats, and an RLC dissector buffer overflow bug. Versions 1.4.0 to 1.4.10 and 1.6.0 to 1.6.4 are affected; upgrading to the new releases fixes these issues.
More details about the updates, including a full list of bug fixes, can be found in the 1.4.11 and 1.6.5 release notes. Wireshark 1.4.11 and 1.6.5 are available to download from the project's site for Windows, Mac OS X and Linux. Source code for Wireshark is licensed under the GPLv2.
See also:
- Multiple Wireshark file parser vulnerabilities, a Wireshark security advisory.
- Wireshark NULL pointer vulnerabilities, a Wireshark security advisory.
- Wireshark RLC dissector buffer overflow, a Wireshark security advisory.
(crve)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
