Total vulnerabilities in the database
In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for compressed (not uncompressed) messages. This was addressed in epan/dissectors/packet-blip.c by allowing reasonable compression ratios and rejecting ZIP bombs.
| Software | From | Fixed in |
|---|---|---|
| wireshark / wireshark | 3.0.0 | 3.0.13.x |
| wireshark / wireshark | 3.2.0 | 3.2.6.x |
| fedoraproject / fedora | 31 | 31.x |
| fedoraproject / fedora | 32 | 32.x |
| fedoraproject / fedora | 33 | 33.x |
| opensuse / leap | 15.1 | 15.1.x |
| opensuse / leap | 15.2 | 15.2.x |
| oracle / zfs_storage_appliance_kit | 8.8 | 8.8.x |