Wireshark 2.6.5 Released With Fixes for Number of Vulnerabilities that Could Crash the Wireshark

The most popular and widely used network protocol analyzer Wireshark released a new version Wireshark 2.6.5, that comes with the fix for a number of security vulnerabilities that could crash Wireshark by injecting a malformed packet or reading malformed packet trace file.

wnpa-sec-2018-51 – The Wireshark dissection engine could crash.

wnpa-sec-2018-52 – The DCOM dissector could crash.

wnpa-sec-2018-53 – The LBMPDM dissector could crash.

wnpa-sec-2018-54 – The MMSE dissector could go into an infinite loop.

wnpa-sec-2018-55 – The IxVeriWave file parser could crash.

wnpa-sec-2018-56 – The PVFS dissector could crash.

All these vulnerabilities could be exploited by the attacker injecting a malformed packet or by reading a malformed packet trace file. These vulnerabilities affected the following Wireshark versions 2.6.0 to 2.6.4, 2.4.0 to 2.4.10, fixed with 2.6.5, 2.4.11 or later.

wnpa-sec-2018-57 – The ZigBee ZCL dissector could crash. Affected version 2.6.0 to 2.6.4, fixed with 2.6.5.

Other Bug Fixes – Wireshark 2.6.5

VoIP Calls dialog doesn’t include RTP stream when preparing a filter.

Wireshark installs on macOS with permissions for /Library/Application Support/Wireshark that are too restrictive.

Closing Enabled Protocols dialog crashes Wireshark.

Unable to Export Objects → HTTP after sorting columns.

DNS Response to NS query shows as a malformed packet.

Encrypted Alerts corresponds to a wrong selection in the packet bytes pane.

Wireshark crashes/asserts with Qt 5.11.1 and assert/debugsymbols enabled.

ESP will not decode since 2.6.2 – works fine in 2.4.6 or 2.4.8.

text2pcap generates malformed packets when TCP, UDP or SCTP headers are added together with IPv6 header.

Wireshark tries to decode EAP-SIM Pseudonym Identity.

Infinite read loop when extcap exits with error and error message.

MATE unable to extract fields for PDU.

Malformed Packet: SV.

OPC UA Max nesting depth exceeded for a valid packet.

TShark 2.6 does not print GeoIP information.

ISUP (ANSI) packets malformed in WS versions later than 2.4.8.

Handover candidate enquires message not decoded.

TShark piping output in a cmd or PowerShell prompt stops working when GeoIP is enabled.

ICMPv6 with routing header incorrectly placed.

IEEE 802.11 Vendor-Specific fixed fields display as malformed packets.

text2pcap -4 and -6 option should require -i as well.

text2pcap direction sensitivity does not affect dummy ethernet addresses.

MLE security suite displays incorrectly.

Message for incorrect IPv4 option lengths is incorrect.

TACACS+ dissector does not properly reassemble large accounting messages.

NLRI of S-PMSI A-D BGP route not being displayed.

Also, the new version comes with the updated protocol support, Capture File Support and Interfaces support, reads the release notes. The new version can be downloaded from here.

Last September, Wireshark issued security patches for three critical vulnerabilities that allow an unauthenticated, remote attacker to crash the vulnerable installations leads to DoS condition.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Master in Wireshark Network Analysis to keep your self-updated.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Vulnerability in Airline Integration Service enables A Hacker to Gain Entry To User Accounts

A recent security vulnerability in a widely used airline integration service has exposed millions of…

23 minutes ago

Hackers Seize Control of 3,000 Companies Through Critical Vulnerabilities

In a groundbreaking cybersecurity investigation, researchers identified several critical vulnerabilities in a target system, eventually…

53 minutes ago

PoC Exploit Released for Critical Cacti Vulnerability Let Attackers Code Remotely

A critical vulnerability in the Cacti performance monitoring framework tracked as CVE-2025-22604, has been disclosed,…

56 minutes ago

TorNet Backdoor Exploits Windows Scheduled Tasks to Deploy Malware

Cisco Talos researchers have identified an ongoing cyber campaign, active since mid-2024, deploying a previously…

12 hours ago

Hackers Could Bypassing EDR Using Windows Symbolic Links to Disable Service Executables

A groundbreaking technique for exploiting Windows systems has emerged, combining the "Bring Your Own Vulnerable…

12 hours ago

Microsoft Unveils Phishing Attack Protection for Teams Chat

Microsoft has taken a significant step toward enhancing cybersecurity by introducing a new phishing attack…

18 hours ago