<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for wireshark</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:1988-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-07-19T07:32:17Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-07-19T07:32:17Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-07-19T07:32:17Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for wireshark</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for wireshark fixes vulnerabilities that could be
used to trigger dissector crashes or cause dissectors to go into large infinite
loops by making Wireshark read specially crafted packages from the network or
capture files (bsc#1094301).

This includes:

- CVE-2018-11356: DNS dissector crash 
- CVE-2018-11357: Multiple dissectors could consume excessive memory 
- CVE-2018-11358: Q.931 dissector crash
- CVE-2018-11359: The RRC dissector and other dissectors could crash
- CVE-2018-11360: GSM A DTAP dissector crash 
- CVE-2018-11362: LDSS dissector crash 
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-Module-Basesystem-15-2018-1348,SUSE-SLE-Module-Desktop-Applications-15-2018-1348</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181988-1/</URL>
      <Description>Link for SUSE-SU-2018:1988-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-July/004282.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:1988-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1094301</URL>
      <Description>SUSE Bug 1094301</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-11356/</URL>
      <Description>SUSE CVE CVE-2018-11356 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-11357/</URL>
      <Description>SUSE CVE CVE-2018-11357 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-11358/</URL>
      <Description>SUSE CVE CVE-2018-11358 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-11359/</URL>
      <Description>SUSE CVE CVE-2018-11359 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-11360/</URL>
      <Description>SUSE CVE CVE-2018-11360 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-11362/</URL>
      <Description>SUSE CVE CVE-2018-11362 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Basesystem 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Basesystem 15">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15" CPE="cpe:/o:suse:sle-module-basesystem:15">SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Desktop Applications 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Desktop Applications 15">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15" CPE="cpe:/o:suse:sle-module-desktop-applications:15">SUSE Linux Enterprise Module for Desktop Applications 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libwireshark9-2.4.7-3.3.4">
      <FullProductName ProductID="libwireshark9-2.4.7-3.3.4">libwireshark9-2.4.7-3.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libwiretap7-2.4.7-3.3.4">
      <FullProductName ProductID="libwiretap7-2.4.7-3.3.4">libwiretap7-2.4.7-3.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libwscodecs1-2.4.7-3.3.4">
      <FullProductName ProductID="libwscodecs1-2.4.7-3.3.4">libwscodecs1-2.4.7-3.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libwsutil8-2.4.7-3.3.4">
      <FullProductName ProductID="libwsutil8-2.4.7-3.3.4">libwsutil8-2.4.7-3.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="wireshark-2.4.7-3.3.4">
      <FullProductName ProductID="wireshark-2.4.7-3.3.4">wireshark-2.4.7-3.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="wireshark-devel-2.4.7-3.3.4">
      <FullProductName ProductID="wireshark-devel-2.4.7-3.3.4">wireshark-devel-2.4.7-3.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="wireshark-ui-qt-2.4.7-3.3.4">
      <FullProductName ProductID="wireshark-ui-qt-2.4.7-3.3.4">wireshark-ui-qt-2.4.7-3.3.4</FullProductName>
    </Branch>
    <Relationship ProductReference="libwireshark9-2.4.7-3.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:libwireshark9-2.4.7-3.3.4">libwireshark9-2.4.7-3.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwiretap7-2.4.7-3.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:libwiretap7-2.4.7-3.3.4">libwiretap7-2.4.7-3.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwscodecs1-2.4.7-3.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:libwscodecs1-2.4.7-3.3.4">libwscodecs1-2.4.7-3.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwsutil8-2.4.7-3.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:libwsutil8-2.4.7-3.3.4">libwsutil8-2.4.7-3.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="wireshark-2.4.7-3.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Basesystem 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Basesystem 15:wireshark-2.4.7-3.3.4">wireshark-2.4.7-3.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="wireshark-devel-2.4.7-3.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Desktop Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-devel-2.4.7-3.3.4">wireshark-devel-2.4.7-3.3.4 as a component of SUSE Linux Enterprise Module for Desktop Applications 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="wireshark-ui-qt-2.4.7-3.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Desktop Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-ui-qt-2.4.7-3.3.4">wireshark-ui-qt-2.4.7-3.3.4 as a component of SUSE Linux Enterprise Module for Desktop Applications 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.</Note>
    </Notes>
    <CVE>CVE-2018-11356</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwireshark9-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwiretap7-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwscodecs1-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwsutil8-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:wireshark-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-devel-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-ui-qt-2.4.7-3.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181988-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11356.html</URL>
        <Description>CVE-2018-11356</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1094301</URL>
        <Description>SUSE Bug 1094301</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.</Note>
    </Notes>
    <CVE>CVE-2018-11357</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwireshark9-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwiretap7-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwscodecs1-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwsutil8-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:wireshark-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-devel-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-ui-qt-2.4.7-3.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181988-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11357.html</URL>
        <Description>CVE-2018-11357</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1094301</URL>
        <Description>SUSE Bug 1094301</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.</Note>
    </Notes>
    <CVE>CVE-2018-11358</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwireshark9-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwiretap7-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwscodecs1-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwsutil8-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:wireshark-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-devel-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-ui-qt-2.4.7-3.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181988-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11358.html</URL>
        <Description>CVE-2018-11358</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1094301</URL>
        <Description>SUSE Bug 1094301</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the RRC dissector and other dissectors could crash. This was addressed in epan/proto.c by avoiding a NULL pointer dereference.</Note>
    </Notes>
    <CVE>CVE-2018-11359</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwireshark9-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwiretap7-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwscodecs1-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwsutil8-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:wireshark-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-devel-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-ui-qt-2.4.7-3.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181988-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11359.html</URL>
        <Description>CVE-2018-11359</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1094301</URL>
        <Description>SUSE Bug 1094301</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP dissector could crash. This was addressed in epan/dissectors/packet-gsm_a_dtap.c by fixing an off-by-one error that caused a buffer overflow.</Note>
    </Notes>
    <CVE>CVE-2018-11360</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwireshark9-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwiretap7-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwscodecs1-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwsutil8-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:wireshark-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-devel-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-ui-qt-2.4.7-3.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181988-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11360.html</URL>
        <Description>CVE-2018-11360</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1094301</URL>
        <Description>SUSE Bug 1094301</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character.</Note>
    </Notes>
    <CVE>CVE-2018-11362</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwireshark9-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwiretap7-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwscodecs1-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:libwsutil8-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Basesystem 15:wireshark-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-devel-2.4.7-3.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Desktop Applications 15:wireshark-ui-qt-2.4.7-3.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20181988-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11362.html</URL>
        <Description>CVE-2018-11362</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1094301</URL>
        <Description>SUSE Bug 1094301</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
