include::attributes.adoc[]
:stylesheet: ws.css
:linkcss:

= Wireshark {wireshark-version} Release Notes
// Asciidoctor Syntax Quick Reference:
// https://asciidoctor.org/docs/asciidoc-syntax-quick-reference/

== What is Wireshark?

Wireshark is the world’s most popular network protocol analyzer.
It is used for troubleshooting, analysis, development and education.

== What’s New

// The Windows installers now ship with Npcap 1.31.
// They previously shipped with Npcap 1.10.

// The Windows installers now ship with USBPcap 1.5.X.0.
// They previously shipped with USBPcap 1.5.4.0.

// The Windows installers now ship with Qt 5.15.2.
// They previously shipped with Qt 5.12.1.

This release fixes a https://gitlab.com/wireshark/wireshark/-/issues/17623[forward compatibility issue] with the I/O Graphs preferences.

=== Bug Fixes

The following vulnerabilities have been fixed:

* wssalink:2021-07[]
Bluetooth DHT dissector crash.
wsbuglink:17651[].
cveidlink:2021-39929[].
// Fixed in master: ed98abe2
// Fixed in release-3.6: 1ffe0cef
// Fixed in release-3.4: 4cd492c1
// Fixed in master-3.2: 98056d8f
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-674: Uncontrolled Recursion

* wssalink:2021-08[]
Bluetooth HCI_ISO dissector crash.
wsbuglink:17649[].
cveidlink:2021-39926[].
// Fixed in master: acaaad15
// Fixed in release-3.6: da8a707b
// Fixed in release-3.4: 5077529f
// Fixed in master-3.2: n/a
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

* wssalink:2021-09[]
Bluetooth SDP dissector crash.
wsbuglink:17635[].
cveidlink:2021-39925[].
// Fixed in master: e15e9874
// Fixed in release-3.6: 492a7038
// Fixed in release-3.4: b18691c5
// Fixed in master-3.2: ae45fcd6
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

* wssalink:2021-10[]
Bluetooth DHT dissector large loop.
wsbuglink:17677[].
cveidlink:2021-39924[].
// Fixed in master: 79a9fe1c
// Fixed in release-3.6: e138ec5d
// Fixed in release-3.4: d3c762dc
// Fixed in master-3.2: 2f017bb7
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-834: Excessive Iteration

* wssalink:2021-11[]
PNRP dissector large loop.
wsbuglink:17684[].
// cveidlink:2021-xxxxx[].
// Fixed in master: 9104a374
// Fixed in release-3.6: f21b9447
// Fixed in release-3.4: d6d15b97
// Fixed in master-3.2: 81b5d29c
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-834: Excessive Iteration

* wssalink:2021-12[]
C12.22 dissector crash.
wsbuglink:17636[].
cveidlink:2021-39922[].
// Fixed in master: b760c356
// Fixed in release-3.6: 1b9972ae
// Fixed in release-3.4: 7ac1d5be
// Fixed in master-3.2: 9a1ef88c
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

* wssalink:2021-13[]
IEEE 802.11 dissector crash.
wsbuglink:17704[].
cveidlink:2021-39928[].
// Fixed in master: 0b473c01
// Fixed in release-3.6: ab3bb461
// Fixed in release-3.4: 00581507
// Fixed in master-3.2: 8f6d0c79
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-476: NULL Pointer Dereference

* wssalink:2021-14[]
Modbus dissector crash.
wsbuglink:17703[].
cveidlink:2021-39921[].
// Fixed in master: bb41b661
// Fixed in release-3.6: e1efbe23
// Fixed in release-3.4: 55c12cc7
// Fixed in master-3.2: 9e453dd5
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-476: NULL Pointer Dereference

* wssalink:2021-15[]
IPPUSB dissector crash.
wsbuglink:17705[].
cveidlink:2021-39920[].
// Fixed in master: 72ad7d9c
// Fixed in release-3.6: 8c0020e0
// Fixed in release-3.4: a59cb43c
// Fixed in master-3.2: n/a
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-476: NULL Pointer Dereference

The following bugs have been fixed:

//* wsbuglink:5000[]
//* wsbuglink:6000[Wireshark bug]
//* cveidlink:2014-2486[]
//* Wireshark exposed details your sordid redneck past, which were subsequently widely disseminated on social media.
// cp /dev/null /tmp/buglist.txt ; for bugnumber in `git log v3.4.4rc0.. | gsed -e 's/\(close\|fix\|resolv\)[^ ]* #/\nclose #/gI' | grep ^close | sed -e 's/close.*#\([1-9][0-9]*\).*/\1/' | sort -V -u` ; do "$(git rev-parse --show-toplevel)/tools/gen-bugnote" $bugnumber; pbpaste >> /tmp/buglist.txt; done

* OSS-Fuzz: Heap-use-after-free in ROS wsbuglink:16342[].

* Allow for '\0' (NULL) character as filter instead of requiring 0x00 for the character match wsbuglink:16525[].

* Dumpcap with threads reports double received count vs captured wsbuglink:17089[].

* I/O Graphs values reset to default with 3.5 due to change of UAT wsbuglink:17623[].

* HTTP2 dissector reports an assertion error on large data frames wsbuglink:17633[].

* TShark stops capturing when capturing with multiple files and packet printing enabled wsbuglink:17654[].

* Wireshark is unable to decode the IMSI IE received in BSSMAP Perform Location request wsbuglink:17667[].

* WSLUA: Crash on reload if Proto has no fields wsbuglink:17668[].

* Crash in flow analysis for TCP wsbuglink:17722[].

=== New and Updated Features

// === Removed Features and Support

//=== Removed Dissectors

// === New File Format Decoding Support

// [commaize]
// --
// --

=== New Protocol Support

There are no new protocols in this release.

=== Updated Protocol Support

// Add one protocol per line between the -- delimiters.
// ag -A1 '(define PSNAME|proto_register_protocol[^_])' $(git diff --name-only v3.4.9.. | ag packet- | sort -u)
[commaize]
--
BT-DHT
BT HCI_ISO
BT SDP
C12.22
CAN FD
CSN1
EAPOL-MKA
EVS
GSM BSSMAP LE
HTTP2
IDMP
IEEE 1905.1a
IEEE 802.11
IPPUSB
Modbus
PNRP
TCP
--

=== New and Updated Capture File Support

// There is no new or updated capture file support in this release.
// Add one file type per line between the -- delimiters.
[commaize]
--
pcap
--

// === New and Updated Capture Interfaces support

//_Non-empty section placeholder._

// === Major API Changes

== Getting Wireshark

Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages.
You can usually install or upgrade Wireshark using the package management system specific to that platform.
A list of third-party packages can be found on the
https://www.wireshark.org/download.html#thirdparty[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
These locations vary from platform to platform.
You can use About → Folders to find the default locations on your system.

== Getting Help

The User’s Guide, manual pages and various other documentation can be found at
https://www.wireshark.org/docs/

Community support is available on
https://ask.wireshark.org/[Wireshark’s Q&A site]
and on the wireshark-users mailing list.
Subscription information and archives for all of Wireshark’s mailing lists can be found on
https://www.wireshark.org/lists/[the web site].

Issues and feature requests can be reported on
https://gitlab.com/wireshark/wireshark/-/issues[the issue tracker].

// Official Wireshark training and certification are available from
// https://www.wiresharktraining.com/[Wireshark University].

== Frequently Asked Questions

A complete FAQ is available on the
https://www.wireshark.org/faq.html[Wireshark web site].
