Source: wireshark X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for wireshark. We should also ship 4.4.19 via trixie-securiy, could someone of the Wireshark maintainers please prepare an update?` CVE-2026-95386[0]: | TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of | service https://www.wireshark.org/security/wnpa-sec-2026-94 https://gitlab.com/wireshark/wireshark/-/issues/21501 CVE-2026-95387[1]: | SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 | allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-97 https://gitlab.com/wireshark/wireshark/-/issues/21487 CVE-2026-95388[2]: | Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows | denial of service https://www.wireshark.org/security/wnpa-sec-2026-101 https://gitlab.com/wireshark/wireshark/-/issues/21545 CVE-2026-95389[3]: | SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 | allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-93 https://gitlab.com/wireshark/wireshark/-/issues/21481 CVE-2026-95390[4]: | PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of | service https://www.wireshark.org/security/wnpa-sec-2026-95 https://gitlab.com/wireshark/wireshark/-/issues/21503 CVE-2026-95391[5]: | ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial | of service https://www.wireshark.org/security/wnpa-sec-2026-92 https://gitlab.com/wireshark/wireshark/-/merge_requests/26096 CVE-2026-95392[6]: | MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 | allows denial of service https://gitlab.com/wireshark/wireshark/-/issues/21549 https://gitlab.com/wireshark/wireshark/-/issues/21550 CVE-2026-95393[7]: | CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 | allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-99 https://gitlab.com/wireshark/wireshark/-/issues/21510 CVE-2026-95394[8]: | Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 | and 4.4.0 to 4.4.18 allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-98 https://gitlab.com/wireshark/wireshark/-/issues/21523 CVE-2026-95395[9]: | IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 | to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-96 https://gitlab.com/wireshark/wireshark/-/issues/21492 CVE-2026-96415[10]: | Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and | 4.4.0 to 4.4.18 allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-110 https://gitlab.com/wireshark/wireshark/-/issues/21589 CVE-2026-96416[11]: | IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to | 4.4.18 allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-109 https://gitlab.com/wireshark/wireshark/-/issues/21564 CVE-2026-96417[12]: | RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 | allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-104 https://gitlab.com/wireshark/wireshark/-/issues/21574 CVE-2026-96418[13]: | TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to | 4.4.18 allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-107 https://gitlab.com/wireshark/wireshark/-/issues/21565 CVE-2026-96419[14]: | Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows | denial of service and possible code execution https://www.wireshark.org/security/wnpa-sec-2026-106 https://gitlab.com/wireshark/wireshark/-/issues/21553 CVE-2026-96420[15]: | Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 | allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-105 https://gitlab.com/wireshark/wireshark/-/issues/21541 CVE-2026-96421[16]: | USB HID protocol dissector infinite loop and memory leak in 4.6.0 to | 4.6.8 and 4.4.0 to 4.4.18 allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-103 https://gitlab.com/wireshark/wireshark/-/issues/21566 CVE-2026-96422[17]: | Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to | 4.4.18 allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-102 https://gitlab.com/wireshark/wireshark/-/issues/21525 CVE-2026-96423[18]: | X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 | allows denial of service https://www.wireshark.org/security/wnpa-sec-2026-108 https://gitlab.com/wireshark/wireshark/-/issues/21563 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-95386 https://www.cve.org/CVERecord?id=CVE-2026-95386 [1] https://security-tracker.debian.org/tracker/CVE-2026-95387 https://www.cve.org/CVERecord?id=CVE-2026-95387 [2] https://security-tracker.debian.org/tracker/CVE-2026-95388 https://www.cve.org/CVERecord?id=CVE-2026-95388 [3] https://security-tracker.debian.org/tracker/CVE-2026-95389 https://www.cve.org/CVERecord?id=CVE-2026-95389 [4] https://security-tracker.debian.org/tracker/CVE-2026-95390 https://www.cve.org/CVERecord?id=CVE-2026-95390 [5] https://security-tracker.debian.org/tracker/CVE-2026-95391 https://www.cve.org/CVERecord?id=CVE-2026-95391 [6] https://security-tracker.debian.org/tracker/CVE-2026-95392 https://www.cve.org/CVERecord?id=CVE-2026-95392 [7] https://security-tracker.debian.org/tracker/CVE-2026-95393 https://www.cve.org/CVERecord?id=CVE-2026-95393 [8] https://security-tracker.debian.org/tracker/CVE-2026-95394 https://www.cve.org/CVERecord?id=CVE-2026-95394 [9] https://security-tracker.debian.org/tracker/CVE-2026-95395 https://www.cve.org/CVERecord?id=CVE-2026-95395 [10] https://security-tracker.debian.org/tracker/CVE-2026-96415 https://www.cve.org/CVERecord?id=CVE-2026-96415 [11] https://security-tracker.debian.org/tracker/CVE-2026-96416 https://www.cve.org/CVERecord?id=CVE-2026-96416 [12] https://security-tracker.debian.org/tracker/CVE-2026-96417 https://www.cve.org/CVERecord?id=CVE-2026-96417 [13] https://security-tracker.debian.org/tracker/CVE-2026-96418 https://www.cve.org/CVERecord?id=CVE-2026-96418 [14] https://security-tracker.debian.org/tracker/CVE-2026-96419 https://www.cve.org/CVERecord?id=CVE-2026-96419 [15] https://security-tracker.debian.org/tracker/CVE-2026-96420 https://www.cve.org/CVERecord?id=CVE-2026-96420 [16] https://security-tracker.debian.org/tracker/CVE-2026-96421 https://www.cve.org/CVERecord?id=CVE-2026-96421 [17] https://security-tracker.debian.org/tracker/CVE-2026-96422 https://www.cve.org/CVERecord?id=CVE-2026-96422 [18] https://security-tracker.debian.org/tracker/CVE-2026-96423 https://www.cve.org/CVERecord?id=CVE-2026-96423 Please adjust the affected versions in the BTS as needed.
