CVE-2017-9347

Name	CVE-2017-9347
Description	In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	864058

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wireshark (PTS)	bullseye	3.4.10-0+deb11u1	fixed
	bullseye (security)	3.4.16-0+deb11u1	fixed
	bookworm	4.0.17-0+deb12u1	fixed
	bookworm (security)	4.0.11-1~deb12u1	fixed
	sid, trixie	4.4.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
wireshark	source	wheezy	(not affected)
wireshark	source	jessie	(not affected)
wireshark	source	(unstable)	2.2.7-1	864058

Notes

[stretch] - wireshark <no-dsa> (Minor issue)
[jessie] - wireshark <not-affected> (Only affects 2.2.x)
[wheezy] - wireshark <not-affected> (Only affects 2.2.x)
https://www.wireshark.org/security/wnpa-sec-2017-31.html
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13637