include::attributes.asciidoc[]

= Wireshark {wireshark-version} Release Notes
// AsciiDoc quick reference: http://powerman.name/doc/asciidoc

== What is Wireshark?

Wireshark is the world's most popular network protocol analyzer. It is
used for troubleshooting, analysis, development and education.

== What's New

=== Bug Fixes

The following vulnerabilities have been fixed:

* wssalink:2019-02[]
The P_MUL dissector could crash.
// * Buildbot crash output: fuzz-2018-12-05-10088.pcap.
wsbuglink:15337[].
cveidlink:2019-5717[].
// Fixed in master: 3cccd4ec5b
// Fixed in master-2.6: 3caa4cde0d
// Fixed in master-2.4: bf9272a92f

* wssalink:2019-03[]
The RTSE dissector and other dissectors could crash.
// * Wireshark heap out-of-bounds read in get_t61_string.
wsbuglink:15373[].
cveidlink:2019-5718[].
// Fixed in master: 3aad1ef236
// Fixed in master-2.6: 9b4a937c88
// Fixed in master-2.4: cd09cb5cfb

* wssalink:2019-04[]
The ISAKMP dissector could crash.
// * Wireshark NULL pointer dereference in dissect_transform.
wsbuglink:15374[].
cveidlink:2019-5719[].
// Fixed in master: c9cfae7fec
// Fixed in master-2.6: cd4b3f5d69
// Fixed in master-2.4: b5b02f2a9b

* wssalink:2019-05[]
The ISAKMP dissector could crash.
// * Crafted CIP packets causes heap-use-after-free.
wsbuglink:14470[].
// cveidlink:2019-xxxx[].
// Fixed in master: 177962a5b4
// Fixed in master-2.6: 177962a5b4
// Fixed in master-2.4: 1c66174ec7

The following bugs have been fixed:

//* wsbuglink:5000[]
//* wsbuglink:6000[Wireshark bug]
//* cveidlink:2014-2486[]
//* Wireshark keeps leaving voicemails advertising timeshare condominiums in Fresno. (wsbuglink:0000[])
// cp /dev/null /tmp/buglist.txt ; for bugnumber in `git log --stat v2.4.13rc0..| grep ' Bug:' | awk '{print $2}' | sort -n -u ` ; do ./tools/gen-bugnote $bugnumber; pbpaste >> /tmp/buglist.txt; done

* console.lua not found in a folder with non-ASCII characters in its name. wsbuglink:15118[].

* Disabling 'Update list of packets in real time.' will generally trigger crash after three start capture, stop capture cycles. wsbuglink:15263[].

* UDP Multicast Stream double counts. wsbuglink:15271[].

* text2pcap et al. set snaplength to 64kiB-1, while processing frames of 256kiB. wsbuglink:15292[].

* Builds without libpcap fail if the libpcap headers aren't installed. wsbuglink:15317[].

* TCAP AnalogRedirectRecord parameter incorrectly coded as mandatory in QualReq_rr message. wsbuglink:15350[].

* Wireshark jumps behind other windows when opening UAT dialogs. wsbuglink:15366[].

* Pathnames containing non-ASCII characters are mangled in error dialogs on Windows. wsbuglink:15367[].

* Executing `-z http,stat -r file.pcapng` throws a segmentation fault. wsbuglink:15369[].

* IS-41 TCAP RegistrationNotification Invoke has borderCellAccess parameter coded as tag 50 (as denyAccess) but should be 58. wsbuglink:15372[].

* GTPv2 APN dissect problem. wsbuglink:15383[].

=== New and Updated Features

There are no new features in this release.

//=== Removed Dissectors

//=== New File Format Decoding Support

=== New Protocol Support

There are no new protocols in this release.

=== Updated Protocol Support

--sort-and-group--
ANSI MAP
ENIP
GSM A
GTPv2
IMF
ISAKMP
P_MUL
RTSE
TCAP
--sort-and-group--

=== New and Updated Capture File Support

There is no new or updated capture file support in this release.
// --sort-and-group--
// --sort-and-group--

=== New and Updated Capture Interfaces support

There are no new or updated capture interfaces supported in this release.
//--sort-and-group--
//--sort-and-group--

//=== Major API Changes

//_Non-empty section placeholder._

== Getting Wireshark

Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages. You can
usually install or upgrade Wireshark using the package management system
specific to that platform. A list of third-party packages can be found
on the https://www.wireshark.org/download.html#thirdparty[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference
files, plugins, SNMP MIBS, and RADIUS dictionaries. These locations vary
from platform to platform. You can use About→Folders to find the default
locations on your system.

== Known Problems

Dumpcap might not quit if Wireshark or TShark crashes.
(wsbuglink:1419[])

The BER dissector might infinitely loop.
(wsbuglink:1516[])

Capture filters aren't applied when capturing from named pipes.
(wsbuglink:1814[])

Filtering tshark captures with read filters (-R) no longer works.
(wsbuglink:2234[])

Application crash when changing real-time option.
(wsbuglink:4035[])

Wireshark and TShark will display incorrect delta times in some cases.
(wsbuglink:4985[])

Wireshark should let you work with multiple capture files. (wsbuglink:10488[])

== Getting Help

Community support is available on https://ask.wireshark.org/[Wireshark's
Q&A site] and on the wireshark-users mailing list. Subscription
information and archives for all of Wireshark's mailing lists can be
found on https://www.wireshark.org/lists/[the web site].

Official Wireshark training and certification are available from
http://www.wiresharktraining.com/[Wireshark University].

== Frequently Asked Questions

A complete FAQ is available on the
https://www.wireshark.org/faq.html[Wireshark web site].
