Branches for Feisty

Author: Frederic Peters
Revision Date: 2007-03-01 10:25:29 UTC

debian/patches/10_wireshark_gen.dpatch: removed as it is no longer
necessary. (closes: #412963)

Author: Stephan Rügamer
Revision Date: 2007-11-29 13:52:52 UTC

* SECURITY UPDATE:
  + CVE-2007-6121: Wireshark (formerly Ethereal) 0.8.16 to 0.99.6 allows
    remote attackers to cause a denial of service (crash) via a malformed RPC
    Portmap packet.
  + CVE-2007-6120: The Bluetooth SDP dissector Wireshark (formerly Ethereal)
    0.99.2 to 0.99.6 allows remote attackers to cause a denial of service
    (infinite loop) via unknown vectors.
  + CVE-2007-6117: Unspecified vulnerability in the HTTP dissector for
    Wireshark (formerly Ethereal) 0.10.14 to 0.99.6 has unknown impact and remote
    attack vectors related to chunked messages.
  + CVE-2007-6114: Multiple buffer overflows in Wireshark (formerly
    Ethereal) 0.99.0 through 0.99.6 allow remote attackers to cause a denial of
    service (crash) and possibly execute arbitrary code via (1) the SSL dissector
    or (2) the iSeries (OS/400) Communication trace file parser.
  + CVE-2007-6113: Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows
    remote attackers to cause a denial of service (long loop) via a malformed DNP
    packet.
* debian/patches/13_CVE-2007-6121.dpatch:
  - Applied patch by upstream
  - Link: http://bugs.wireshark.org/bugzilla/attachment.cgi?id=1132
* debian/patches/13_CVE-2007-6120.dpatch:
  - Applied patch by upstream
  - Link: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-btsdp.c?r1=21431&r2=23496&view=patch
* debian/patches/13_CVE-2007-6117.dpatch:
  - Applied patch by upstream
  - Link: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-http.c?r1=22515&r2=23415&view=patch
* debian/patches/13_CVE-2007-6114.dpatch:
  - Applied patch by upstream
  - Link 1: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-ssl-utils.h?r1=21445&r2=22883&view=patch
  - Link 2: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-ssl.c?r1=22625&r2=22883&view=patch
  - Link 3: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/wiretap/iseries.c?r1=23000&r2=23232&view=patch
* debian/patches/13_CVE-2007-6113.dpatch:
  - Applied patch by upstream
  - Link: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-dnp.c?r1=22764&r2=22811&view=patch
* References:
  CVE-2007-6121
  CVE-2007-6120
  CVE-2007-6117
  CVE-2007-6114
  CVE-2007-6113
  http://www.wireshark.org/security/wnpa-sec-2007-03.html

Author: Stephan Rügamer
Revision Date: 2007-11-29 13:52:52 UTC

* SECURITY UPDATE:
  + CVE-2007-6121: Wireshark (formerly Ethereal) 0.8.16 to 0.99.6 allows
    remote attackers to cause a denial of service (crash) via a malformed RPC
    Portmap packet.
  + CVE-2007-6120: The Bluetooth SDP dissector Wireshark (formerly Ethereal)
    0.99.2 to 0.99.6 allows remote attackers to cause a denial of service
    (infinite loop) via unknown vectors.
  + CVE-2007-6117: Unspecified vulnerability in the HTTP dissector for
    Wireshark (formerly Ethereal) 0.10.14 to 0.99.6 has unknown impact and remote
    attack vectors related to chunked messages.
  + CVE-2007-6114: Multiple buffer overflows in Wireshark (formerly
    Ethereal) 0.99.0 through 0.99.6 allow remote attackers to cause a denial of
    service (crash) and possibly execute arbitrary code via (1) the SSL dissector
    or (2) the iSeries (OS/400) Communication trace file parser.
  + CVE-2007-6113: Wireshark (formerly Ethereal) 0.10.12 to 0.99.6 allows
    remote attackers to cause a denial of service (long loop) via a malformed DNP
    packet.
* debian/patches/13_CVE-2007-6121.dpatch:
  - Applied patch by upstream
  - Link: http://bugs.wireshark.org/bugzilla/attachment.cgi?id=1132
* debian/patches/13_CVE-2007-6120.dpatch:
  - Applied patch by upstream
  - Link: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-btsdp.c?r1=21431&r2=23496&view=patch
* debian/patches/13_CVE-2007-6117.dpatch:
  - Applied patch by upstream
  - Link: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-http.c?r1=22515&r2=23415&view=patch
* debian/patches/13_CVE-2007-6114.dpatch:
  - Applied patch by upstream
  - Link 1: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-ssl-utils.h?r1=21445&r2=22883&view=patch
  - Link 2: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-ssl.c?r1=22625&r2=22883&view=patch
  - Link 3: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/wiretap/iseries.c?r1=23000&r2=23232&view=patch
* debian/patches/13_CVE-2007-6113.dpatch:
  - Applied patch by upstream
  - Link: http://anonsvn.wireshark.org/viewvc/viewvc.py/trunk-0.99.7/epan/dissectors/packet-dnp.c?r1=22764&r2=22811&view=patch
* References:
  CVE-2007-6121
  CVE-2007-6120
  CVE-2007-6117
  CVE-2007-6114
  CVE-2007-6113
  http://www.wireshark.org/security/wnpa-sec-2007-03.html