openSUSE Security Update: Security update for wireshark, libvirt, sbc, libqt5-qtmultimedia
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2021:0909-1
Rating:             important
References:         #1179930 #1179931 #1179932 #1179933 #1180102 
                    #1180232 #1181598 #1181599 #1183353 #1184110 
                    #1185128 
Cross-References:   CVE-2020-26418 CVE-2020-26419 CVE-2020-26420
                    CVE-2020-26421 CVE-2020-26422 CVE-2021-22173
                    CVE-2021-22174 CVE-2021-22191 CVE-2021-22207
                   
CVSS scores:
                    CVE-2020-26418 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2020-26418 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2020-26419 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2020-26420 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2020-26420 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
                    CVE-2020-26421 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2020-26421 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2020-26422 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2020-26422 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2021-22173 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-22173 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2021-22174 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-22174 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2021-22191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2021-22191 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2021-22207 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-22207 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected Products:
                    openSUSE Leap 15.2
______________________________________________________________________________

   An update that solves 9 vulnerabilities and has two fixes
   is now available.

Description:

   This update for wireshark, libvirt, sbc and libqt5-qtmultimedia fixes the
   following issues:

   Update wireshark to version 3.4.5

   - New and updated support and bug fixes for multiple protocols
   - Asynchronous DNS resolution is always enabled
   - Protobuf fields can be dissected as Wireshark (header) fields
   - UI improvements

   Including security fixes for:

   - CVE-2021-22191: Wireshark could open unsafe URLs (bsc#1183353).
   - CVE-2021-22207: MS-WSP dissector excessive memory consumption
     (bsc#1185128)
   - CVE-2020-26422: QUIC dissector crash (bsc#1180232)
   - CVE-2020-26418: Kafka dissector memory leak (bsc#1179930)
   - CVE-2020-26419: Multiple dissector memory leaks (bsc#1179931)
   - CVE-2020-26420: RTPS dissector memory leak (bsc#1179932)
   - CVE-2020-26421: USB HID dissector crash (bsc#1179933)
   - CVE-2021-22173: Fix USB HID dissector memory leak (bsc#1181598)
   - CVE-2021-22174: Fix USB HID dissector crash (bsc#1181599)

   libqt5-qtmultimedia and sbc are necessary dependencies. libvirt is needed
   to rebuild wireshark-plugin-libvirt.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.2:

      zypper in -t patch openSUSE-2021-909=1



Package List:

   - openSUSE Leap 15.2 (i586 x86_64):

      libwireshark14-3.4.5-lp152.2.12.1
      libwireshark14-debuginfo-3.4.5-lp152.2.12.1
      libwiretap11-3.4.5-lp152.2.12.1
      libwiretap11-debuginfo-3.4.5-lp152.2.12.1
      libwsutil12-3.4.5-lp152.2.12.1
      libwsutil12-debuginfo-3.4.5-lp152.2.12.1
      wireshark-3.4.5-lp152.2.12.1
      wireshark-debuginfo-3.4.5-lp152.2.12.1
      wireshark-debugsource-3.4.5-lp152.2.12.1
      wireshark-devel-3.4.5-lp152.2.12.1
      wireshark-ui-qt-3.4.5-lp152.2.12.1
      wireshark-ui-qt-debuginfo-3.4.5-lp152.2.12.1


References:

   https://www.suse.com/security/cve/CVE-2020-26418.html
   https://www.suse.com/security/cve/CVE-2020-26419.html
   https://www.suse.com/security/cve/CVE-2020-26420.html
   https://www.suse.com/security/cve/CVE-2020-26421.html
   https://www.suse.com/security/cve/CVE-2020-26422.html
   https://www.suse.com/security/cve/CVE-2021-22173.html
   https://www.suse.com/security/cve/CVE-2021-22174.html
   https://www.suse.com/security/cve/CVE-2021-22191.html
   https://www.suse.com/security/cve/CVE-2021-22207.html
   https://bugzilla.suse.com/1179930
   https://bugzilla.suse.com/1179931
   https://bugzilla.suse.com/1179932
   https://bugzilla.suse.com/1179933
   https://bugzilla.suse.com/1180102
   https://bugzilla.suse.com/1180232
   https://bugzilla.suse.com/1181598
   https://bugzilla.suse.com/1181599
   https://bugzilla.suse.com/1183353
   https://bugzilla.suse.com/1184110
   https://bugzilla.suse.com/1185128