| Summary: | wireshark new releases 1.8.13 and 1.10.6 fix security issues | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | marc.lattemann, sysadmin-bugs, tmb |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/590188/ | ||
| Whiteboard: | MGA3TOO has_procedure advisory MGA4-64-OK MGA3-32-OK MGA3-64-OK MGA4-32-OK | ||
| Source RPM: | wireshark-1.10.5-1.mga4.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2014-03-08 06:58:25 CET
David Walser
2014-03-08 06:58:31 CET
Whiteboard:
(none) =>
MGA3TOO poc for CVE-2014-2281: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9672 poc for CVE-2014-2283: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9730 poc for CVE-2014-2299: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9843 CC:
(none) =>
marc.lattemann testing on MGA4 64bit: after activating of update_testing repos and run urpmi wireshark, the dependencies dumpcap, lib64wireshark3, ib64wiretap3 and lib64wsutil3 will not be updated... e.g. [root@localhost marc]# rpm -qa | grep wireshark wireshark-1.10.6-1.mga4 lib64wireshark3-1.10.5-1.mga4 [root@localhost marc]# sample file for CVE-2014-2281 and CVE-2014-2299 are causing segmentation fault until dependencies are updated manually as well... After new installation of wireshark (with all dependencies) from update_testing repos) fixed both bugs. Did I made a mistake here? Furthermore I don't know how to get CVE-2014-2283 to work. Never got same messages like in the linked bugreport... (same result prior and after update). But I think that I'm doing something wrong, since I don't get tshark/dumpcap running without being root Whiteboard:
MGA3TOO =>
MGA3TOO has_procedure feedback (In reply to Marc Lattemann from comment #2) > testing on MGA4 64bit: > > after activating of update_testing repos and run urpmi wireshark, > the dependencies dumpcap, lib64wireshark3, ib64wiretap3 and lib64wsutil3 > will not be updated... > > e.g. > [root@localhost marc]# rpm -qa | grep wireshark > wireshark-1.10.6-1.mga4 > lib64wireshark3-1.10.5-1.mga4 > [root@localhost marc]# > > sample file for CVE-2014-2281 and CVE-2014-2299 are causing segmentation > fault until dependencies are updated manually as well... After new > installation of wireshark (with all dependencies) from update_testing repos) > fixed both bugs. > > Did I made a mistake here? > Nope, when using the updates_testing packages you usually need to manually select the deps as you dont have it as an "update" repo. when it ends up in updates, urpmi and update applet will update all the packages ... This is actually something I think we should improve in packaging, as it will be needed to be able to do cherrypicking of backports CC:
(none) =>
tmb (In reply to Thomas Backlund from comment #3) > Nope, when using the updates_testing packages you usually need to manually > select the deps as you dont have it as an "update" repo. Thanks for the info, Thomas (In reply to Marc Lattemann from comment #2) > Furthermore I don't know how to get CVE-2014-2283 to work. Never got same > messages like in the linked bugreport... (same result prior and after > update). But I think that I'm doing something wrong, since I don't get > tshark/dumpcap running without being root Ok- got it working as usual user, however, can't reproduce bug. Since no regression after updating packages and update will fix other bugs, I put tested tag for mga4 64bit to whiteboard. Please feel free to remove since someone will test-procedure for CVE-2014-2283. Whiteboard:
MGA3TOO has_procedure =>
MGA3TOO has_procedure mga4-64-OK same result in mga3 32bit: CVE-2014-2281 and CVE-2014-2299 could be reproduced in old version and are solved after upgrade. CVE-2014-2283 could not be reproduced, but basic wireshark functions are tested and no regression detected. Whiteboard:
MGA3TOO has_procedure mga4-64-OK =>
MGA3TOO has_procedure MGA4-64-OK MGA3-32-OK tested successfully on MGA3 64bit Whiteboard:
MGA3TOO has_procedure MGA4-64-OK MGA3-32-OK =>
MGA3TOO has_procedure MGA4-64-OK MGA3-32-OK MGA3-64-OK tested successfully on MGA4 32bit after Advisory from Comment #0 is uploaded, update can be validated and pushed to core_udpates Whiteboard:
MGA3TOO has_procedure MGA4-64-OK MGA3-32-OK MGA3-64-OK =>
MGA3TOO has_procedure MGA4-64-OK MGA3-32-OK MGA3-64-OK MGA4-32-OK Thanks Marc Separate advisories uploaded for 3 & 4. Validating. Could sysadmin please push to 3 & 4 updates Thanks Keywords:
(none) =>
validated_update
claire robinson
2014-03-08 21:24:19 CET
Whiteboard:
MGA3TOO has_procedure MGA4-64-OK MGA3-32-OK MGA3-64-OK MGA4-32-OK =>
MGA3TOO has_procedure advisory MGA4-64-OK MGA3-32-OK MGA3-64-OK MGA4-32-OK Mga3 update pushed: http://advisories.mageia.org/MGASA-2014-0125.html Mga4 update pushed: http://advisories.mageia.org/MGASA-2014-0126.html Status:
NEW =>
RESOLVED
David Walser
2014-03-10 18:02:17 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/590188/ LWN reference for CVE-2014-2282: http://lwn.net/Vulnerabilities/590192/ |