Oracle ZFS Storage Appliance Firmware vulnerabilities

3 CVEs affecting Oracle ZFS Storage Appliance Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-26575, published 2020-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-25863, published 2020-10-06. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multipart.c by correcting the deallocation of…
CVE-2020-26575, published 2020-10-06. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was addressed in epan/dissectors/packet-fbzero.c by correcting the implementation of…
CVE-2020-25862, published 2020-10-06. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by changing the handling of the invalid 0xFFFF…