diff --git a/wireshark-0014-cve-2026-5405.patch b/wireshark-0014-cve-2026-5405.patch new file mode 100644 index 0000000..6ec4d65 --- /dev/null +++ b/wireshark-0014-cve-2026-5405.patch @@ -0,0 +1,48 @@ +From 45eb952b12e95dfe72e0994976d2ec2714fd193a Mon Sep 17 00:00:00 2001 +From: John Thacker +Date: Mon, 23 Mar 2026 13:02:49 +0000 +Subject: [PATCH] RDP: Check for too long segments on the uncompressed path + +The RDP 8.0 compression limits the maximum number of uncompressed +bytes in a single segment to 65,535 [MS-RDPEGFX] 3.1.9.1.2. +Check for that in the uncompressed path. + +Fix #21105 + +AI-Assisted: no + + +(cherry picked from commit 87fb30a03d19bb2a0c8597e10c38f1657310fafd) + +Co-authored-by: John Thacker +--- + epan/tvbuff_rdp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/epan/tvbuff_rdp.c b/epan/tvbuff_rdp.c +index 948ec1cf2d6..2cfb89b1e2a 100644 +--- a/epan/tvbuff_rdp.c ++++ b/epan/tvbuff_rdp.c +@@ -157,7 +157,8 @@ static const zgfx_token_t ZGFX_MATCH_TABLE[] = { + { 9, 382, 24, 17094304 }, // 101111110 + }; + +- ++/* Limits from [MS-RDPEGFX] 3.1.9.1.2 (So failures here are malformed ++ * packets, not limitations of the implementation.) */ + struct _zgfx_context_t{ + uint8_t historyBuffer[2500000]; + uint32_t historyIndex; +@@ -338,6 +339,9 @@ rdp8_decompress_segment(zgfx_context_t *zgfx, tvbuff_t *tvb) + len--; + + if (!(flags & ZGX_PACKET_COMPRESSED)) { ++ if (len > 65535) { ++ return false; ++ } + tvbuff_t *raw = tvb_new_subset_remaining(tvb, 1); + zgfx_write_history_buffer_tvb(zgfx, raw, len); + +-- +GitLab + diff --git a/wireshark-0015-cve-2026-5656.patch b/wireshark-0015-cve-2026-5656.patch new file mode 100644 index 0000000..12bca04 --- /dev/null +++ b/wireshark-0015-cve-2026-5656.patch @@ -0,0 +1,49 @@ +From 9c458883e8ecaf86c08092420d92408c70ffa7fc Mon Sep 17 00:00:00 2001 +From: Roland Knall +Date: Mon, 23 Mar 2026 13:11:05 +0000 +Subject: [PATCH] Qt::Guard better when loading zip files + +Prevent traversal attacks using malicously created zip-files + +Closes #21115 +AI-Assisted: no + +AI-Assisted: no|yes [tool(s)] + + +(cherry picked from commit 70c86bd39c74fc0052c9a212afc911b41d612388) + +Co-authored-by: Roland Knall +--- + ui/qt/utils/wireshark_zip_helper.cpp | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/ui/qt/utils/wireshark_zip_helper.cpp b/ui/qt/utils/wireshark_zip_helper.cpp +index a295001cfcc..773cff3172b 100644 +--- a/ui/qt/utils/wireshark_zip_helper.cpp ++++ b/ui/qt/utils/wireshark_zip_helper.cpp +@@ -86,6 +86,7 @@ bool WiresharkZipHelper::unzip(QString zipFile, QString directory, bool (*fileCh + return false; + + QMap cleanPaths; ++ QString canonicalDir = QFileInfo(di.path()).canonicalFilePath(); + + for (unsigned int cnt = 0; cnt < nmbr; cnt++) + { +@@ -112,6 +113,13 @@ bool WiresharkZipHelper::unzip(QString zipFile, QString directory, bool (*fileCh + continue; + } + ++#ifndef _WIN32 ++ /* Reject paths outside the extraction root, to prevent directory traversal attacks on Posix systems */ ++ if (!QFileInfo(fileInZip).absoluteFilePath().startsWith(canonicalDir + "/")) { ++ continue; ++ } ++#endif ++ + if (di.exists()) + { + #ifdef _WIN32 +-- +GitLab + diff --git a/wireshark.spec b/wireshark.spec index d47f13e..576fe4c 100644 --- a/wireshark.spec +++ b/wireshark.spec @@ -6,7 +6,7 @@ Summary: Network traffic analyzer Name: wireshark Version: 4.4.2 -Release: 4%{?dist}.4 +Release: 10%{?dist} Epoch: 1 License: BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND MIT AND GPL-2.0-or-later AND LGPL-2.0-or-later AND Zlib AND ISC AND (BSD-3-Clause OR GPL-2.0-only) AND (GPL-2.0-or-later AND Zlib) Url: http://www.wireshark.org/ @@ -33,6 +33,10 @@ Patch10: wireshark-0010-cve-2025-13499.patch Patch11: wireshark-0011-cve-2025-9817.patch Patch12: wireshark-0012-cve-2026-3201.patch Patch13: wireshark-0013-cve-2026-3203.patch +# Upstream fix: https://gitlab.com/wireshark/wireshark/-/commit/45eb952 +Patch14: wireshark-0014-cve-2026-5405.patch +# Upstream fix: https://gitlab.com/wireshark/wireshark/-/commit/9c45888 +Patch15: wireshark-0015-cve-2026-5656.patch #install tshark together with wireshark GUI Requires: %{name}-cli = %{epoch}:%{version}-%{release} @@ -285,17 +289,23 @@ fi %{_libdir}/pkgconfig/%{name}.pc %changelog -* Tue Apr 07 2026 Michal Ruprich - 1:4.4.2-4.4 -- Resolves: RHEL-152921 - CVE-2026-3203 Buffer Over-read +* Wed May 13 2026 Michal Ruprich - 1:4.4.2-10 +- Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory -* Sat Apr 04 2026 Michal Ruprich - 1:4.4.2-4.3 -- Resolves: RHEL-152912 - CVE-2026-3201 Improperly Controlled Sequential Memory Allocation +* Wed May 13 2026 Michal Ruprich - 1:4.4.2-9 +- Resolves: RHEL-173218 - CVE-2026-5405 Heap-based Buffer Overflow -* Sun Jan 25 2026 Michal Ruprich - 1:4.4.2-4.2 -- Resolves: RHEL-136916 - NULL Pointer Dereference in Wireshark (CVE-2025-9817) +* Thu Apr 23 2026 Michal Ruprich - 1:4.4.2-8 +- Resolves: RHEL-152922 - CVE-2026-3203 Buffer Over-read -* Mon Dec 08 2025 Michal Ruprich - 1:4.4.2-4.1 -- Resolves: RHEL-130425 - Access of Uninitialized Pointer in Wireshark +* Thu Apr 23 2026 Michal Ruprich - 1:4.4.2-7 +- Resolves: RHEL-152913 - CVE-2026-3201 Improperly Controlled Sequential Memory Allocation + +* Sun Jan 25 2026 Michal Ruprich - 1:4.4.2-6 +- Resolves: RHEL-136919 - NULL Pointer Dereference in Wireshark (CVE-2025-9817) + +* Mon Jan 19 2026 Michal Ruprich - 1:4.4.2-5 +- Resolves: RHEL-130427 - Access of Uninitialized Pointer in Wireshark * Tue Jun 10 2025 Michal Ruprich - 1:4.4.2-4 - Resolves: RHEL-91194 - RFE - Wireshark with LUA support