Gentoo Archives: gentoo-announce

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 201702-30 ] tcpdump: Multiple vulnerabilities
Date: Tue, 21 Feb 2017 00:53:05
Message-Id: ee37b002-6f62-fe76-1949-09cfb3f45add@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201702-30
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: tcpdump: Multiple vulnerabilities
9 Date: February 21, 2017
10 Bugs: #606516
11 ID: 201702-30
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in tcpdump, the worst of which
19 may allow execution of arbitrary code.
20
21 Background
22 ==========
23
24 tcpdump is a tool for network monitoring and data acquisition.
25
26 Affected packages
27 =================
28
29 -------------------------------------------------------------------
30 Package / Vulnerable / Unaffected
31 -------------------------------------------------------------------
32 1 net-analyzer/tcpdump < 4.9.0 >= 4.9.0
33
34 Description
35 ===========
36
37 Multiple vulnerabilities have been discovered in tcpdump. Please review
38 the CVE identifiers referenced below for details.
39
40 Impact
41 ======
42
43 A remote attacker, by sending a specially crafted network package,
44 could possibly execute arbitrary code with the privileges of the
45 process or cause a Denial of Service condition.
46
47 Workaround
48 ==========
49
50 There is no known workaround at this time.
51
52 Resolution
53 ==========
54
55 All tcpdump users should upgrade to the latest version:
56
57 # emerge --sync
58 # emerge --ask --oneshot --verbose ">=net-analyzer/tcpdump-4.9.0"
59
60 References
61 ==========
62
63 [ 1 ] CVE-2016-7922
64 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7922
65 [ 2 ] CVE-2016-7923
66 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7923
67 [ 3 ] CVE-2016-7924
68 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7924
69 [ 4 ] CVE-2016-7925
70 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7925
71 [ 5 ] CVE-2016-7926
72 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7926
73 [ 6 ] CVE-2016-7927
74 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7927
75 [ 7 ] CVE-2016-7928
76 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7928
77 [ 8 ] CVE-2016-7929
78 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7929
79 [ 9 ] CVE-2016-7930
80 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7930
81 [ 10 ] CVE-2016-7931
82 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7931
83 [ 11 ] CVE-2016-7932
84 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7932
85 [ 12 ] CVE-2016-7933
86 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7933
87 [ 13 ] CVE-2016-7934
88 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7934
89 [ 14 ] CVE-2016-7935
90 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7935
91 [ 15 ] CVE-2016-7936
92 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7936
93 [ 16 ] CVE-2016-7937
94 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7937
95 [ 17 ] CVE-2016-7938
96 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7938
97 [ 18 ] CVE-2016-7939
98 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7939
99 [ 19 ] CVE-2016-7940
100 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7940
101 [ 20 ] CVE-2016-7973
102 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7973
103 [ 21 ] CVE-2016-7974
104 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7974
105 [ 22 ] CVE-2016-7975
106 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7975
107 [ 23 ] CVE-2016-7983
108 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7983
109 [ 24 ] CVE-2016-7984
110 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7984
111 [ 25 ] CVE-2016-7985
112 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7985
113 [ 26 ] CVE-2016-7986
114 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7986
115 [ 27 ] CVE-2016-7992
116 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7992
117 [ 28 ] CVE-2016-7993
118 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7993
119 [ 29 ] CVE-2016-8574
120 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8574
121 [ 30 ] CVE-2016-8575
122 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8575
123 [ 31 ] CVE-2017-5202
124 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5202
125 [ 32 ] CVE-2017-5203
126 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5203
127 [ 33 ] CVE-2017-5204
128 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5204
129 [ 34 ] CVE-2017-5205
130 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5205
131 [ 35 ] CVE-2017-5341
132 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5341
133 [ 36 ] CVE-2017-5342
134 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5342
135 [ 37 ] CVE-2017-5482
136 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5482
137 [ 38 ] CVE-2017-5483
138 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5483
139 [ 39 ] CVE-2017-5484
140 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5484
141 [ 40 ] CVE-2017-5485
142 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5485
143 [ 41 ] CVE-2017-5486
144 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5486
145
146 Availability
147 ============
148
149 This GLSA and any updates to it are available for viewing at
150 the Gentoo Security Website:
151
152 https://security.gentoo.org/glsa/201702-30
153
154 Concerns?
155 =========
156
157 Security is a primary focus of Gentoo Linux and ensuring the
158 confidentiality and security of our users' machines is of utmost
159 importance to us. Any security concerns should be addressed to
160 security@g.o or alternatively, you may file a bug at
161 https://bugs.gentoo.org.
162
163 License
164 =======
165
166 Copyright 2017 Gentoo Foundation, Inc; referenced text
167 belongs to its owner(s).
168
169 The contents of this document are licensed under the
170 Creative Commons - Attribution / Share Alike license.
171
172 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature