Your message dated Sun, 11 Oct 2026 11:52:38 +0000
with message-id <[email protected]>
and subject line Bug#1149644: fixed in wireshark 4.4.19-0+deb13u1
has caused the Debian Bug report #1149644,
regarding wireshark: CVE-2026-95386 CVE-2026-95387 CVE-2026-95388
CVE-2026-95389 CVE-2026-95390 CVE-2026-95391 CVE-2026-95392 CVE-2026-95393
CVE-2026-95394 CVE-2026-95395 CVE-2026-96415 CVE-2026-96416 CVE-2026-96417
CVE-2026-96418 CVE-2026-96419 CVE-2026-96420 CVE-2026-96421 CVE-2026-96422
CVE-2026-96423
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149644: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149644
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: wireshark
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for wireshark.
We should also ship 4.4.19 via trixie-securiy, could someone of
the Wireshark maintainers please prepare an update?`
CVE-2026-95386[0]:
| TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of
| service
https://www.wireshark.org/security/wnpa-sec-2026-94
https://gitlab.com/wireshark/wireshark/-/issues/21501
CVE-2026-95387[1]:
| SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-97
https://gitlab.com/wireshark/wireshark/-/issues/21487
CVE-2026-95388[2]:
| Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows
| denial of service
https://www.wireshark.org/security/wnpa-sec-2026-101
https://gitlab.com/wireshark/wireshark/-/issues/21545
CVE-2026-95389[3]:
| SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-93
https://gitlab.com/wireshark/wireshark/-/issues/21481
CVE-2026-95390[4]:
| PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of
| service
https://www.wireshark.org/security/wnpa-sec-2026-95
https://gitlab.com/wireshark/wireshark/-/issues/21503
CVE-2026-95391[5]:
| ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial
| of service
https://www.wireshark.org/security/wnpa-sec-2026-92
https://gitlab.com/wireshark/wireshark/-/merge_requests/26096
CVE-2026-95392[6]:
| MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://gitlab.com/wireshark/wireshark/-/issues/21549
https://gitlab.com/wireshark/wireshark/-/issues/21550
CVE-2026-95393[7]:
| CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-99
https://gitlab.com/wireshark/wireshark/-/issues/21510
CVE-2026-95394[8]:
| Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8
| and 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-98
https://gitlab.com/wireshark/wireshark/-/issues/21523
CVE-2026-95395[9]:
| IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0
| to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-96
https://gitlab.com/wireshark/wireshark/-/issues/21492
CVE-2026-96415[10]:
| Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and
| 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-110
https://gitlab.com/wireshark/wireshark/-/issues/21589
CVE-2026-96416[11]:
| IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to
| 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-109
https://gitlab.com/wireshark/wireshark/-/issues/21564
CVE-2026-96417[12]:
| RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-104
https://gitlab.com/wireshark/wireshark/-/issues/21574
CVE-2026-96418[13]:
| TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to
| 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-107
https://gitlab.com/wireshark/wireshark/-/issues/21565
CVE-2026-96419[14]:
| Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows
| denial of service and possible code execution
https://www.wireshark.org/security/wnpa-sec-2026-106
https://gitlab.com/wireshark/wireshark/-/issues/21553
CVE-2026-96420[15]:
| Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-105
https://gitlab.com/wireshark/wireshark/-/issues/21541
CVE-2026-96421[16]:
| USB HID protocol dissector infinite loop and memory leak in 4.6.0 to
| 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-103
https://gitlab.com/wireshark/wireshark/-/issues/21566
CVE-2026-96422[17]:
| Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to
| 4.4.18 allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-102
https://gitlab.com/wireshark/wireshark/-/issues/21525
CVE-2026-96423[18]:
| X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18
| allows denial of service
https://www.wireshark.org/security/wnpa-sec-2026-108
https://gitlab.com/wireshark/wireshark/-/issues/21563
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-95386
https://www.cve.org/CVERecord?id=CVE-2026-95386
[1] https://security-tracker.debian.org/tracker/CVE-2026-95387
https://www.cve.org/CVERecord?id=CVE-2026-95387
[2] https://security-tracker.debian.org/tracker/CVE-2026-95388
https://www.cve.org/CVERecord?id=CVE-2026-95388
[3] https://security-tracker.debian.org/tracker/CVE-2026-95389
https://www.cve.org/CVERecord?id=CVE-2026-95389
[4] https://security-tracker.debian.org/tracker/CVE-2026-95390
https://www.cve.org/CVERecord?id=CVE-2026-95390
[5] https://security-tracker.debian.org/tracker/CVE-2026-95391
https://www.cve.org/CVERecord?id=CVE-2026-95391
[6] https://security-tracker.debian.org/tracker/CVE-2026-95392
https://www.cve.org/CVERecord?id=CVE-2026-95392
[7] https://security-tracker.debian.org/tracker/CVE-2026-95393
https://www.cve.org/CVERecord?id=CVE-2026-95393
[8] https://security-tracker.debian.org/tracker/CVE-2026-95394
https://www.cve.org/CVERecord?id=CVE-2026-95394
[9] https://security-tracker.debian.org/tracker/CVE-2026-95395
https://www.cve.org/CVERecord?id=CVE-2026-95395
[10] https://security-tracker.debian.org/tracker/CVE-2026-96415
https://www.cve.org/CVERecord?id=CVE-2026-96415
[11] https://security-tracker.debian.org/tracker/CVE-2026-96416
https://www.cve.org/CVERecord?id=CVE-2026-96416
[12] https://security-tracker.debian.org/tracker/CVE-2026-96417
https://www.cve.org/CVERecord?id=CVE-2026-96417
[13] https://security-tracker.debian.org/tracker/CVE-2026-96418
https://www.cve.org/CVERecord?id=CVE-2026-96418
[14] https://security-tracker.debian.org/tracker/CVE-2026-96419
https://www.cve.org/CVERecord?id=CVE-2026-96419
[15] https://security-tracker.debian.org/tracker/CVE-2026-96420
https://www.cve.org/CVERecord?id=CVE-2026-96420
[16] https://security-tracker.debian.org/tracker/CVE-2026-96421
https://www.cve.org/CVERecord?id=CVE-2026-96421
[17] https://security-tracker.debian.org/tracker/CVE-2026-96422
https://www.cve.org/CVERecord?id=CVE-2026-96422
[18] https://security-tracker.debian.org/tracker/CVE-2026-96423
https://www.cve.org/CVERecord?id=CVE-2026-96423
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: wireshark
Source-Version: 4.4.19-0+deb13u1
Done: Matheus Polkorny <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wireshark, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Matheus Polkorny <[email protected]> (supplier of updated wireshark package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 02 Oct 2026 10:45:05 -0300
Source: wireshark
Architecture: source
Version: 4.4.19-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Balint Reczey <[email protected]>
Changed-By: Matheus Polkorny <[email protected]>
Closes: 1149644
Changes:
wireshark (4.4.19-0+deb13u1) trixie-security; urgency=medium
.
* Team upload.
* New upstream version 4.4.19 (Closes: #1149644)
- CVE-2026-95387: SPDY dissector crash, allows DoS
- CVE-2026-95388: Crash in sharkd, allows DoS
- CVE-2026-95389: SCTP dissector crash, allows DoS
- CVE-2026-95392: MBIM dissector crash, allows DoS
- CVE-2026-95393: CSN.1 dissector crash, allows DoS
- CVE-2026-95394: MNM parser large loop, allows DoS
- CVE-2026-95395: IEEE C37.118 dissector memory leak, allows DoS
- CVE-2026-96415: Catapult DCT2000 dissector crash, allows DoS
- CVE-2026-96416: IEEE 802.11 dissector crash, allows DoS
- CVE-2026-96417: RF4CE dissector crash, allows DoS
- CVE-2026-96418: TIFF dissector infinite loop, allows DoS
- CVE-2026-96419: Profile import crash, possible code execution
- CVE-2026-96420: Toshiba parser crash, allows DoS
- CVE-2026-96421: USB HID dissector memory leak, allows DoS
- CVE-2026-96422: Frame metadissector crash, allows DoS
- CVE-2026-96423: X11 dissector crash, allows DoS
Checksums-Sha1:
b62a1f0ea604ffb674ccf4eeced30c04ef786869 3499 wireshark_4.4.19-0+deb13u1.dsc
2d718085f8333949148dd8018113d0a92d9049d2 50796578 wireshark_4.4.19.orig.tar.bz2
4b1f73388c734cbad0985b10547adb9f4348d68e 87512
wireshark_4.4.19-0+deb13u1.debian.tar.xz
cc88f1f7f7650ae9636d09c7d1afee0c6e6556c8 14877
wireshark_4.4.19-0+deb13u1_source.buildinfo
Checksums-Sha256:
cdc3da9ba5ed1fb7256f215a530a705971dc671ec1bb8e965951bc99cbddb1ca 3499
wireshark_4.4.19-0+deb13u1.dsc
de24c95b1b613ff794fbb7b8d13559c9301f6a844d43082ad3bef809bbe3b4ba 50796578
wireshark_4.4.19.orig.tar.bz2
db50fbff6890edcf28c1938af22831c4425c1f016064959f3941dc093f688aa6 87512
wireshark_4.4.19-0+deb13u1.debian.tar.xz
c4b6a1d306a8bef3286ba5319151140e39978e9524635f39edea85eb54a4bba9 14877
wireshark_4.4.19-0+deb13u1_source.buildinfo
Files:
0e1bd1043fa9f9ea69551226f3773887 3499 net optional
wireshark_4.4.19-0+deb13u1.dsc
12b7b1bbce77e512fac8fb84da06a71b 50796578 net optional
wireshark_4.4.19.orig.tar.bz2
8162f61ea48e11fb5c63de3e6c910e47 87512 net optional
wireshark_4.4.19-0+deb13u1.debian.tar.xz
c969c325a8c2151811a836cb2565f3dc 14877 net optional
wireshark_4.4.19-0+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEcRD/fHLtdypUR2KKShyoWjj77loFAmq/x8sUHHBvbGtvcm55
QGRlYmlhbi5vcmcACgkQShyoWjj77lrM4w/9FOimlgOwOEGwc1vIK7OvxGv9ca3R
CON0Vcv3vojQHzS6dKimq/Sf8IknnZX0R2HNhYkyQ/b75efltV8148vLd2v4kEmg
bvnOY7+k0au28916C37uBjdH1WrNVnWxQDVxHFXw+T/Z3LC8lfwk8f0Rxf3yO86D
Vm7yglJIYJqYenrGasz7Tz0tvp/C5rqpQsNK+42ZL4VD0ICGQSFbwMRASYq6xB/E
3p+AmYV6fB+oKCQrfemdXjmgmzMPhmimsq0BwScETMbszOdnvWlqPc6dH1Z9nfKt
3/A2nIKKbFRc78PKimbp7c5JqGr+PeqofOoTv681ab6gLvSgmvdQBbjCEntmcxTX
q2TN4e/fiOVkFqRaaoupiHx7QQPZObF5cOzNNtbNquFu9Owdw0IdNeOqN8Iqhh6w
GHv81S+bqdho/CZEW/2GkAJ7YXOAS31+e4AJt830a3XJ3KSuqAI4UorpP1v46AjX
/wG8Y+bdMSvspn7lzjxxS8WHADRIDAJ8aGbPSm1FQt1UD++f0kNuI7ihEq4N6JMq
Zl00fM8xydAmY6kTiIfn8dg1JOI4oVQ3ZVIZ5luqL06/6ELul2RdV92BFc09gEoL
I7sEVg+vvuagGuyWod7nJ6XRsjb6j99VtaLWjoSjcssoF3STyB4Q9W+U3B1XygLz
B4hAjopq6S0AtNE=
=XOLS
-----END PGP SIGNATURE-----
pgpuv_m_8WQ5q.pgp
Description: PGP signature
--- End Message ---
