wireshark-4.4.1

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

Two security fixes in this one

[Douglas R. Reno]

 What’s New

  Bug Fixes

   The following vulnerabilities have been fixed:

     • wnpa-sec-2024-12[2] ITS dissector crash. Issue 20026[3].

     • wnpa-sec-2024-13[4] AppleTalk and RELOAD Framing dissector
       crashes. Issue 20114[5].

   The following bugs have been fixed:

     • Refresh interface during live-capture leads to corrupt interface
       handling. Issue 11176[6].

     • Media type "application/octet-stream" registered for both Thread
       and UASIP. Issue 14729[7].

     • Extcap toolbar stops working when new interface is added. Issue
       19854[8].

     • Decoding error ITS CPM version 2.1.1. Issue 19886[9].

     • Build error in 4.3.0: sync_pipe_run_command_actual error:
       argument 2 is null but the corresponding size argument 3 value is
       512004 [-Werror=nonnull] Issue 19930[10].

     • html2text.py doesn’t handle the `<sup>` tag. Issue 20020[11].

     • Incorrect NetFlow v8 TOS AS aggregation dissection. Issue
       20021[12].

     • The Windows packages don’t ship with the IP address plugin. Issue
       20030[13].

     • O_PATH is Linux-and-FreeBSD-specific. Issue 20031[14].

     • Wireshark 4.4.0 doesn’t install USBcap USBcapCMD.exe in the
       correct directory. Issue 20040[15].

     • OER dissector is not considering the preamble if ASN.1 SEQUENCE
       definition includes extension marker but no OPTIONAL items. Issue
       20044[16].

     • Bluetooth classic L2CAP incorrect dissection with connectionless
       reception channel. Issue 20047[17].

     • Profile auto switch filters : Grayed Display Filter Expression
       dialog box when opened from Configuration Profiles dialog box.
       Issue 20049[18].

     • TECMP Data Type passes too much data to sub dissectors. Issue
       20052[19].

     • Wireshark and tshark 4.4.0 ignore extcap options specified on the
       command line. Issue 20054[20].

     • Cannot open release notes due to incorrect path with duplicated
       directory components. Issue 20055[21].

     • Unable to open "Release Notes" from the "Help" menu. Issue
       20056[22].

     • No capture interfaces if Wireshark is started from command line
       with certain paths. Issue 20057[23].

     • Wireshark 4.4.0 extcap path change breaks third party extcap
       installers. Issue 20069[24].

     • Fuzz job UTF-8 encoding issue: fuzz-2024-09-10-7618.pcap. Issue
       20071[25].

     • Unable to create larger files than 99 size units. Issue
       20079[26].

     • PRP trailer not shown for L2 IEC 61850 GOOSE packets in 4.4.0
       (was working in 4.2.7) Issue 20088[27].

     • GUI lags because NetworkManager keeps turning 802.11 monitor mode
       off. Issue 20090[28].

     • Error while getting Bluetooth application process id by <shell:ps
       -A | grep com.*android.bluetooth> Issue 20100[29].

     • Fuzz job assertion: randpkt-2024-10-05-7200.pcap. Issue
       20110[30].

 Known Bugs

    • Wireshark 4.4.0 / macOS 14.6.1 wifi if monitor mode. Issue
      20051[31].

    • Opening Wireshark 4.4.0 on macOS 15.0 disconnects iPhone
      Mirroring. Issue 20082[32].

  New and Updated Features

     • The TShark syntax for dumping only fields with a certain prefix
       has changed from `-G fields prefix` to `-G fields,prefix`. This
       allows `tshark -G fields` to again support also specifying the
       configuration profile to use.

  New Protocol Support

   There are no new protocols in this release.

  Updated Protocol Support

   AppleTalk, ARTNET, BGP, BT L2CAP, CIGI, CIP Motion, CoAP, COSE,
   DISTCC, DMP, Ethernet OAM PDU, F5 FILEINFO, GIOP, GOOSE, GSM
   Management, GSM SIM, GTP, HTTP, HTTP2, ID3v2, IDN, IEEE 1609.2, IEEE
   802.11, IPPUSB, iRDMA, ISystemActivator, ITS, Kerberos, LwM2M-TLV,
   MMS, MQ, MySQL, NCP SSS, NetFlow, OER, OWAMP, QNET, RELOAD Framing,
   RTCP, RTLS, SANE, SMB2, SSyncP, Sysdig Event, T.124, TECMP, Thread,
   Thrift, and TWAMP

  New and Updated Capture File Support

   BLF, CLLOG, CommView, ERF, and pcap

  Updated File Format Decoding Support

   There is no updated file format support in this release.

[Douglas R. Reno]

Fixed at 2778b33fec1f72f5fa118c389baaca10a0be84c4

SA-12.2-028 issued