TECH Signal 420
Wireshark 4.6.8 patches over two dozen vulnerabilities and moves extcap binaries to libexec
↗
Wireshark 4.6.8 is a maintenance release fixing over two dozen vulnerabilities across protocol dissectors and capture-file parsers, resolving several crash bugs, updating existing dissectors, and documenting a previously unannounced packaging change that moves extcap helper binaries to the libexec directory on Unix-like systems.
The vulnerability fixes address crashes in commonly used dissectors like SSH, Kerberos, and RDP that could be triggered by crafted capture files, making this a security-relevant upgrade. The undocumented packaging change for extcap binaries means third-party extcap plugins on Unix-like systems may break unless their installation paths are adjusted or the WIRESHARK_EXTCAP_DIR environment variable is set.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Over two dozen vulnerabilities fixed across dissectors including RDP, SSH, Kerberos, and capture-file parsers including pcapng and Endace ERF.
Bug fixes include a segmentation fault in TCP sequence analysis, a stack buffer overflow in K12/RF5 writer, and stack exhaustion from nested NetLog JSON data.
Extcap helper binaries on Unix-like systems now default to the libexec directory, potentially breaking third-party extcap packages unless WIRESHARK_EXTCAP_DIR is set.
THE CLUSTER