wireshark: Multiple vulnerabilities (CVE-2020-26575, CVE-2020-28030)

CVE-2020-26575: FBZERO dissector could enter an infinite loop

In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero.c by correcting the implementation of offset advancement.

Fixed versions: 3.4.0, 3.2.8

Reference:

https://www.wireshark.org/security/wnpa-sec-2020-14.html

CVE-2020-28030: GQUIC dissector crash

In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.

Fixed versions: 3.4.0, 3.2.8

Reference:

https://www.wireshark.org/security/wnpa-sec-2020-15.html

Affected branches:

• master
• 3.12-stable