From 2daaf12a521d12dde846a83c5aee7bfe41895419 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Thu, 13 Aug 2026 18:48:35 +0800 Subject: [PATCH] Fix CVE-2026-19695, CVE-2026-19694 --- wireshark-4.6.5-CVE-2026-19694.patch | 63 ++++++++++++++++++++++++++++ wireshark-4.6.5-CVE-2026-19695.patch | 59 ++++++++++++++++++++++++++ wireshark.spec | 8 +++- 3 files changed, 129 insertions(+), 1 deletion(-) create mode 100644 wireshark-4.6.5-CVE-2026-19694.patch create mode 100644 wireshark-4.6.5-CVE-2026-19695.patch diff --git a/wireshark-4.6.5-CVE-2026-19694.patch b/wireshark-4.6.5-CVE-2026-19694.patch new file mode 100644 index 0000000..9797d4a --- /dev/null +++ b/wireshark-4.6.5-CVE-2026-19694.patch @@ -0,0 +1,63 @@ +From ea960718395b7a791ecce1b37ef854f162d856c0 Mon Sep 17 00:00:00 2001 +From: John Thacker +Date: Sat, 18 Jul 2026 20:22:46 -0400 +Subject: [PATCH] TTL: add some bound checks when parsing segmented messages + +Fixes #21389 + +Thanks to Anthropic's Claude and Ada Logics for reporting and PoC. + + +(cherry picked from commit f9fdd24295456219f39be01beeaf734c2e3a8a2c) + +Co-authored-by: Pascal Quantin +--- + wiretap/ttl.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/wiretap/ttl.c b/wiretap/ttl.c +index 95ec416..6c07fd9 100644 +--- a/wiretap/ttl.c ++++ b/wiretap/ttl.c +@@ -2021,10 +2021,15 @@ ttl_check_segmented_message_recursion(const ttl_read_t* in, int* err, char** err + + if (in->validity != VALIDITY_BUF) { + *err = WTAP_ERR_INTERNAL; +- *err_info = ws_strdup("tt_fix_segmented_message_entry_payload: input buffer is not valid"); ++ *err_info = ws_strdup("ttl_check_segmented_message_recursion: input buffer is not valid"); + return false; + } + ++ if (sizeof(ttl_entryheader_t) > in->size - in->cur_pos) { ++ *err = WTAP_ERR_INTERNAL; ++ *err_info = ws_strdup("ttl_check_segmented_message_recursion: input buffer too short"); ++ return false; ++ } + memcpy(&header, in->buf + in->cur_pos, sizeof(ttl_entryheader_t)); + fix_endianness_ttl_entryheader(&header); + +@@ -2045,14 +2050,23 @@ ttl_fix_segmented_message_entry_timestamp(const ttl_read_t* in, uint64_t timesta + + if (in->validity != VALIDITY_BUF) { + *err = WTAP_ERR_INTERNAL; +- *err_info = ws_strdup("tt_fix_segmented_message_entry_payload: input buffer is not valid"); ++ *err_info = ws_strdup("ttl_fix_segmented_message_entry_timestamp: input buffer is not valid"); + return false; + } + ++ if (sizeof(ttl_entryheader_t) > in->size - in->cur_pos) { ++ goto buf_too_small; ++ } + memcpy(&header, in->buf + in->cur_pos, sizeof(ttl_entryheader_t)); + fix_endianness_ttl_entryheader(&header); + + if ((header.size_type >> 12) == TTL_BUS_DATA_ENTRY) { ++ if (sizeof(uint64_t) > in->size - (in->cur_pos + sizeof(ttl_entryheader_t))) { ++ buf_too_small: ++ *err = WTAP_ERR_INTERNAL; ++ *err_info = ws_strdup("ttl_fix_segmented_message_entry_timestamp: input buffer too short"); ++ return false; ++ } + timestamp = GUINT64_TO_LE(timestamp); + memcpy(in->buf + in->cur_pos + sizeof(ttl_entryheader_t), ×tamp, sizeof(uint64_t)); + } diff --git a/wireshark-4.6.5-CVE-2026-19695.patch b/wireshark-4.6.5-CVE-2026-19695.patch new file mode 100644 index 0000000..0ed2451 --- /dev/null +++ b/wireshark-4.6.5-CVE-2026-19695.patch @@ -0,0 +1,59 @@ +From 7a868d2c7a6c1bca6b974be2159ec08bc4505aa0 Mon Sep 17 00:00:00 2001 +From: John Thacker +Date: Sun, 9 Aug 2026 16:14:18 -0400 +Subject: [PATCH] Wiretap: DCT3 Trace: Avoid overflow with extra elements + +A proper Gammu DCT3 trace file only has a single child element +for a given element. The previous parser ignored such child +elements after the first it found with data. We could do more to call +this a bad file. + +Also fix not freeing the XML document in one error path, and test +version greater than or equal to a bounds instead of just equal. + +Fix #21475 + +Thanks to Pedro Pinho for reporting + + +(cherry picked from commit c3e931321e289c33c14a2aa5ffa56962f99fb7d1) + +Co-authored-by: John Thacker +--- + wiretap/dct3trace.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/wiretap/dct3trace.c b/wiretap/dct3trace.c +index a0337bd..0a13a89 100644 +--- a/wiretap/dct3trace.c ++++ b/wiretap/dct3trace.c +@@ -113,7 +113,7 @@ hex2bin(uint8_t *out, uint8_t *out_end, char *in) + in++; + continue; + } +- if (out == out_end) ++ if (out >= out_end) + { + /* Too much data */ + return -1; +@@ -318,7 +318,8 @@ dct3trace_get_packet(wtap* wth, wtap_rec* rec, const char* text, size_t len, int + { + *err = WTAP_ERR_BAD_FILE; + *err_info = ws_strdup_printf("dct3trace: record length %d too long", rec->rec_header.packet_header.caplen); +- return false; ++ status = false; ++ goto end; + } + local_len += data_len; + +@@ -326,6 +327,10 @@ dct3trace_get_packet(wtap* wth, wtap_rec* rec, const char* text, size_t len, int + *(bufp - 1) = data_len << 2 | 0x1; + } + } ++ /* There should be only a single "l2" child element ++ * within a "l1" element, so break. (This keeps us ++ * from writing to bufp a seconds time.) */ ++ break; + } + } + } diff --git a/wireshark.spec b/wireshark.spec index 7141e04..1132305 100644 --- a/wireshark.spec +++ b/wireshark.spec @@ -4,7 +4,7 @@ Summary: Network traffic analyzer Name: wireshark Version: 4.6.5 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL+ Url: http://www.wireshark.org/ @@ -20,6 +20,8 @@ Patch3004: wireshark-0007-cmakelists.patch Patch3005: wireshark-0008-pkgconfig.patch Patch3006: wireshark-0009-remove-strato-manpages.patch Patch0001: wireshark-4.6.5-CVE-2026-5656-cxx14.patch +Patch0002: wireshark-4.6.5-CVE-2026-19695.patch +Patch0003: wireshark-4.6.5-CVE-2026-19694.patch BuildRequires: qt5-qtbase-devel qt5-qtmultimedia-devel qt5-qtsvg-devel BuildRequires: systemd-devel libnghttp2-devel systemd-rpm-macros qt5-qttools-devel qt5-linguist @@ -211,6 +213,10 @@ fi %{_libdir}/cmake/%{name}/*.cmake %changelog +* Thu Aug 13 2026 PkgAgent Robot - 4.6.5-2 +- [Type] security +- [DESC] Fix CVE-2026-19695, CVE-2026-19694 + * Mon May 18 2026 PkgAgent Robot - 4.6.5-1 - [Type] security - [DESC] Update to 4.6.5 (fixes CVE-2026-5656 CVE-2026-5402 CVE-2026-5403 CVE-2026-5405) -- Gitee