Port CVE-2010-4538 forward

This is a vulnerability that allows a buffer overflow in the initialized
data segment area of the target executable and can be used for a DoS
attack and could potentially be used to alter the code execution. This
demo the exploit packet causes tshark to die on a SIGBUS signal. The
code change that fixed this vulnerability can be found at:

http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-enttec.c?r1=35318&r2=35317&pathrev=35318
Port CVE-2010-4300 forward

This is a vulnerability that allows a heap-based buffer overflow in
the dissect_ldss_transfer() function (epan/dissectors/packet-ldss.c)
in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 that allows
remote attackers to cause a denial of service (crash) and possibly
execute arbitrary code via an LDSS packet with a long digest line
that triggers the memory corruption.  The code change that fixed this
vulnerbility can be found at:

http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-ldss.c?r1=34581&r2=34580&pathrev=34581
Port CVE-2013-5719 forward

This is a vulnerability that allows a specially crafted ASSA
Abloy R3 packet to cause Wireshark to enter an infinite loop. In
dissect_r3_upstreamfgfield_checkresults():

        for (i = 0; i < len; i += tvb_get_guint8 (tvb, i))...

if tvb_get_guint8() ever encounters a 0, i never gets incremented and
the code loops forever. The code change that fixed this vulnerbility can
be found at:

http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-assa_r3.c?r1=51196&r2=51195&pathrev=51196
Port CVE-2011-1591 forward

This is stack based buffer overflow in the DECT dissector code that can
be used to execute arbitrary code on the target system. For this demo it
is assumed that stack protection (such as the "-fstack_protect" compiler
option) and Address Space Layout Randomization (ASLR) were not enabled
when wireshark/tshark was compiled and executed. Please note that this
is the default case for the FreeBSD wireshark 1.10.2 port. It has been
demonstrated that stack protection (i.e. Microsoft's Data Execution
Prevention/Safe Structured Exception Handling or DEP/SafeSEH) and ASLR
can be bypassed using a more complicated exploit with this vulnerability
(see http://www.exploit-db.com/exploits/17186/).
Add a RoP gadget function for CVE-2011-1591

For the purpose of this demonstration a simple Return-Oriented
Programming (ROP) "gadget" function ("rop_gadget()") is added to tshark.