rpms/wireshark
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git wireshark-4.4.2-10.el10_2

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-06-25 09:19:23 -04:00
parent a848bfeea5
commit 611f5ecef7
3 changed files with 116 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
wireshark-0014-cve-2026-5405.patch Normal file
View File

@ -0,0 +1,48 @@
From 45eb952b12e95dfe72e0994976d2ec2714fd193a Mon Sep 17 00:00:00 2001
From: John Thacker <johnthacker@gmail.com>
Date: Mon, 23 Mar 2026 13:02:49 +0000
Subject: [PATCH] RDP: Check for too long segments on the uncompressed path
The RDP 8.0 compression limits the maximum number of uncompressed
bytes in a single segment to 65,535 [MS-RDPEGFX] 3.1.9.1.2.
Check for that in the uncompressed path.
Fix #21105
AI-Assisted: no
(cherry picked from commit 87fb30a03d19bb2a0c8597e10c38f1657310fafd)
Co-authored-by: John Thacker <johnthacker@gmail.com>
---
epan/tvbuff_rdp.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/epan/tvbuff_rdp.c b/epan/tvbuff_rdp.c
index 948ec1cf2d6..2cfb89b1e2a 100644
--- a/epan/tvbuff_rdp.c
+++ b/epan/tvbuff_rdp.c
@@ -157,7 +157,8 @@ static const zgfx_token_t ZGFX_MATCH_TABLE[] = {
{ 9, 382, 24, 17094304 }, // 101111110
};
-
+/* Limits from [MS-RDPEGFX] 3.1.9.1.2 (So failures here are malformed
+ * packets, not limitations of the implementation.) */
struct _zgfx_context_t{
uint8_t historyBuffer[2500000];
uint32_t historyIndex;
@@ -338,6 +339,9 @@ rdp8_decompress_segment(zgfx_context_t *zgfx, tvbuff_t *tvb)
len--;
if (!(flags & ZGX_PACKET_COMPRESSED)) {
+ if (len > 65535) {
+ return false;
+ }
tvbuff_t *raw = tvb_new_subset_remaining(tvb, 1);
zgfx_write_history_buffer_tvb(zgfx, raw, len);
--
GitLab

49
wireshark-0015-cve-2026-5656.patch Normal file
View File

@ -0,0 +1,49 @@
From 9c458883e8ecaf86c08092420d92408c70ffa7fc Mon Sep 17 00:00:00 2001
From: Roland Knall <rknall@gmail.com>
Date: Mon, 23 Mar 2026 13:11:05 +0000
Subject: [PATCH] Qt::Guard better when loading zip files
Prevent traversal attacks using malicously created zip-files
Closes #21115
AI-Assisted: no
AI-Assisted: no|yes [tool(s)]
(cherry picked from commit 70c86bd39c74fc0052c9a212afc911b41d612388)
Co-authored-by: Roland Knall <rknall@gmail.com>
---
ui/qt/utils/wireshark_zip_helper.cpp | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/ui/qt/utils/wireshark_zip_helper.cpp b/ui/qt/utils/wireshark_zip_helper.cpp
index a295001cfcc..773cff3172b 100644
--- a/ui/qt/utils/wireshark_zip_helper.cpp
+++ b/ui/qt/utils/wireshark_zip_helper.cpp
@@ -86,6 +86,7 @@ bool WiresharkZipHelper::unzip(QString zipFile, QString directory, bool (*fileCh
return false;
QMap<QString, QString> cleanPaths;
+ QString canonicalDir = QFileInfo(di.path()).canonicalFilePath();
for (unsigned int cnt = 0; cnt < nmbr; cnt++)
{
@@ -112,6 +113,13 @@ bool WiresharkZipHelper::unzip(QString zipFile, QString directory, bool (*fileCh
continue;
}
+#ifndef _WIN32
+ /* Reject paths outside the extraction root, to prevent directory traversal attacks on Posix systems */
+ if (!QFileInfo(fileInZip).absoluteFilePath().startsWith(canonicalDir + "/")) {
+ continue;
+ }
+#endif
+
if (di.exists())
{
#ifdef _WIN32
--
GitLab

28
wireshark.spec
View File

@ -6,7 +6,7 @@
Summary: Network traffic analyzer
Name: wireshark
Version: 4.4.2
Release: 4%{?dist}.4
Release: 10%{?dist}
Epoch: 1
License: BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND MIT AND GPL-2.0-or-later AND LGPL-2.0-or-later AND Zlib AND ISC AND (BSD-3-Clause OR GPL-2.0-only) AND (GPL-2.0-or-later AND Zlib)
Url: http://www.wireshark.org/
@ -33,6 +33,10 @@ Patch10: wireshark-0010-cve-2025-13499.patch
Patch11: wireshark-0011-cve-2025-9817.patch
Patch12: wireshark-0012-cve-2026-3201.patch
Patch13: wireshark-0013-cve-2026-3203.patch
# Upstream fix: https://gitlab.com/wireshark/wireshark/-/commit/45eb952
Patch14: wireshark-0014-cve-2026-5405.patch
# Upstream fix: https://gitlab.com/wireshark/wireshark/-/commit/9c45888
Patch15: wireshark-0015-cve-2026-5656.patch
#install tshark together with wireshark GUI
Requires: %{name}-cli = %{epoch}:%{version}-%{release}
@ -285,17 +289,23 @@ fi
%{_libdir}/pkgconfig/%{name}.pc
%changelog
* Tue Apr 07 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-4.4
- Resolves: RHEL-152921 - CVE-2026-3203 Buffer Over-read
* Wed May 13 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-10
- Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory
* Sat Apr 04 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-4.3
- Resolves: RHEL-152912 - CVE-2026-3201 Improperly Controlled Sequential Memory Allocation
* Wed May 13 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-9
- Resolves: RHEL-173218 - CVE-2026-5405 Heap-based Buffer Overflow
* Sun Jan 25 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-4.2
- Resolves: RHEL-136916 - NULL Pointer Dereference in Wireshark (CVE-2025-9817)
* Thu Apr 23 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-8
- Resolves: RHEL-152922 - CVE-2026-3203 Buffer Over-read
* Mon Dec 08 2025 Michal Ruprich <michalruprich@gmail.com> - 1:4.4.2-4.1
- Resolves: RHEL-130425 - Access of Uninitialized Pointer in Wireshark
* Thu Apr 23 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-7
- Resolves: RHEL-152913 - CVE-2026-3201 Improperly Controlled Sequential Memory Allocation
* Sun Jan 25 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-6
- Resolves: RHEL-136919 - NULL Pointer Dereference in Wireshark (CVE-2025-9817)
* Mon Jan 19 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-5
- Resolves: RHEL-130427 - Access of Uninitialized Pointer in Wireshark
* Tue Jun 10 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-4
- Resolves: RHEL-91194 - RFE - Wireshark with LUA support