include::attributes.adoc[]
:stylesheet: ws.css
:linkcss:
:copycss: {stylesheet}

== Wireshark {wireshark-version} Release Notes
// Asciidoctor Syntax Quick Reference:
// https://asciidoctor.org/docs/asciidoc-syntax-quick-reference/

== What is Wireshark?

Wireshark is the world’s most popular network protocol analyzer.
It is used for troubleshooting, analysis, development and education.

== What’s New

__This is the last release branch with support for 32-bit Windows.__
Updates will no longer be available after May 22, 2024 for that platform.
wsbuglink:17779[]

// The Windows installers now ship with Npcap 1.60.
// They previously shipped with Npcap 1.55.

// The Windows installers now ship with USBPcap 1.5.X.0.
// They previously shipped with USBPcap 1.5.4.0.

// The Windows installers now ship with Qt 5.15.2.
// They previously shipped with Qt 5.12.1.

If you’re running Wireshark on macOS and upgraded to macOS 13 from an earlier version, you will likely have to open and run the “Uninstall ChmodBPF” package, then open and run “Install ChmodBPF” in order to reset the ChmodBPF Launch Daemon.
wsbuglink:18734[].

=== Bug Fixes

The following vulnerabilities have been fixed:

* wssalink:2023-12[]
Candump log file parser crash.
wsbuglink:19062[].
cveidlink:2023-2855[].
// Fixed in master: 0181fafb21
// Fixed in release-4.0: 55dbdaf47c
// Fixed in release-3.6: 9ce7445be0
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-126
// * Stack-buffer-overflow in candump_write_packet. wsbuglink:19062[].

* wssalink:2023-13[]
BLF file parser crash.
wsbuglink:19063[].
cveidlink:2023-2857[].
// Fixed in master: c899be35a9
// Fixed in release-4.0: 35e630ea3e
// Fixed in release-3.6: 6c7199da0c
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-126
// * Heap buffer overflow vulnerability in BLF reader. wsbuglink:19063[].

* wssalink:2023-14[]
GDSDB dissector infinite loop.
wsbuglink:19068[].
// cveidlink:2023-xxxx[].
// Fixed in master: 118815ca7c
// Fixed in release-4.0: 3d3208f762
// Fixed in release-3.6: 3412780abd
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-835
// * Fuzz job crash output: fuzz-2023-05-13-7062.pcap. wsbuglink:19068[].

* wssalink:2023-15[]
NetScaler file parser crash.
wsbuglink:19081[].
cveidlink:2023-2858[].
// Fixed in master: cb190d6839
// Fixed in release-4.0: 74017383c8
// Fixed in release-3.6: a0403c4b39
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-126
// * Heap Buffer Overflow in Wireshark 4.0.5's nstrace_read_v10 Function. wsbuglink:19081[].

* wssalink:2023-16[]
VMS TCPIPtrace file parser crash.
wsbuglink:19083[].
cveidlink:2023-2856[].
// Fixed in master: db5135826d
// Fixed in release-4.0: da017472e6
// Fixed in release-3.6: 1c264ced57
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-126
// * Stack Buffer Overflow in Wireshark 4.0.5's parse_vms_packet Function. wsbuglink:19083[].

* wssalink:2023-19[]
IEEE C37.118 Synchrophasor dissector crash.
wsbuglink:19087[].
cveidlink:2023-0668[].
// Fixed in master: c4f37d77b2
// Fixed in release-4.0: fbe9291d78
// Fixed in release-3.6: c23343d221
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-126
// * IEEE-C37.118 parsing buffer overflow. wsbuglink:19087[].

* wssalink:2023-20[]
XRA dissector infinite loop.
wsbuglink:19100[].
// cveidlink:2023-xxx[].
// Fixed in master: ce87eac032
// Fixed in release-4.0: e18d0e36
// Fixed in release-3.6: 461a1736
// CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
// CWE-835
// * OSS-Fuzz 59248: wireshark:fuzzshark_ip_proto-udp: Timeout in fuzzshark_ip_proto-udp. wsbuglink:19100[].

The following bugs have been fixed:

//* wsbuglink:5000[]
//* wsbuglink:6000[Wireshark bug]
//* cveidlink:2014-2486[]
//* Wireshark keeps banging out random chords on your piano and yelling “LIPS LIKE SUGUAR, SUGAR KISSES” because it was funny that one time at a party.

* Incorrect padding in BFCP decoder wsbuglink:18890[].
* SPNEGO dissector bug wsbuglink:18991[].
* SRT values are incorrect when applying a time shift. wsbuglink:18999[].
* batadv dissector bug wsbuglink:19047[].
* [UDS] When filtering the uds.wdbi.data_identifier or uds.iocbi.data_identifier field is interpreted as 1 byte whereas it consists of 2 bytes wsbuglink:19078[].
* Wireshark can't save this capture in that format wsbuglink:19080[].
* MSMMS parsing buffer overflow wsbuglink:19086[].
* USB HID parser shows wrong label for usages Rx/Vx/Vbrx of usage page Generic Desktop Control wsbuglink:19095[].
* "Follow -> QUIC Stream" mixes data between streams. wsbuglink:19102[].

=== New and Updated Features

// === Removed Features and Support

// === Removed Dissectors

=== New Protocol Support

There are no new protocols in this release.

=== Updated Protocol Support

// Add one protocol per line between the -- delimiters.
// ag -A1 '(define PSNAME|proto_register_protocol[^_])' $(git diff --name-only v3.6.13.. | ag packet- | sort -u)
[commaize]
--
batadv
BFCP
COSE
GDSDB
CommunityID
ILP
ISAKMP
MSMMS
NTLMSSP
QUIC
SPNEGO
Synphasor
TCP
UDS
ULP
USB HID
XRA
--

=== New and Updated Capture File Support

// There is no new or updated capture file support in this release.
// Add one file type per line between the -- delimiters.
[commaize]
--
BLF
Candump
NetScaler
VMS TCPIPtrace
--

=== New File Format Decoding Support

There is no new or updated file format support in this release.
// Add one file type per line between the -- delimiters.
// [commaize]
// --
// --


// === New and Updated Capture Interfaces support

//_Non-empty section placeholder._

// === Major API Changes

== Getting Wireshark

Wireshark source code and installation packages are available from
https://www.wireshark.org/download.html.

=== Vendor-supplied Packages

Most Linux and Unix vendors supply their own Wireshark packages.
You can usually install or upgrade Wireshark using the package management system specific to that platform.
A list of third-party packages can be found on the
https://www.wireshark.org/download.html[download page]
on the Wireshark web site.

== File Locations

Wireshark and TShark look in several different locations for preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
These locations vary from platform to platform.
You can use menu:Help[About Wireshark,Folders] or `tshark -G folders` to find the default locations on your system.

== Getting Help

The User’s Guide, manual pages and various other documentation can be found at
https://www.wireshark.org/docs/

Community support is available on
https://ask.wireshark.org/[Wireshark’s Q&A site]
and on the wireshark-users mailing list.
Subscription information and archives for all of Wireshark’s mailing lists can be found on
https://www.wireshark.org/lists/[the web site].

Bugs and feature requests can be reported on
https://gitlab.com/wireshark/wireshark/-/issues[the issue tracker].

// Official Wireshark training and certification are available from
// https://www.wiresharktraining.com/[Wireshark University].

== How You Can Help

The Wireshark Foundation helps as many people as possible understand their networks as much as possible.
You can find out more and donate at https://wiresharkfoundation.org[wiresharkfoundation.org].

== Frequently Asked Questions

A complete FAQ is available on the
https://www.wireshark.org/faq.html[Wireshark web site].
