Wireshark 4.6.7 Patches Twelve Crash‑Oriented Vulnerabilities and an Information‑Disclosure Bug
What Happened — Wireshark 4.6.7 addresses twelve security‑related flaws across a range of protocol dissectors and file‑parsers, many of which could cause crashes or memory corruption when processing crafted packets or capture files. One parser (BLF) also contained an information‑disclosure issue.
Why It Matters for Compliance & Audit Readiness
- Unpatched parsing bugs violate SOC 2 CC6.1 (Change Management) and CC6.2 (Vulnerability Management) – continuous monitoring of software patches is required evidence.
- Crash‑oriented flaws can lead to service interruption, impacting the Availability principle and the need for documented incident‑response evidence.
- The information‑disclosure bug highlights the importance of data‑handling controls (CC5.1 – Confidentiality) and the need for verifiable remediation tracking.
Who Is Affected — Organizations that rely on Wireshark for network forensics, IDS/IPS tuning, or security operations across any sector (e.g., finance, healthcare, cloud services).
Recommended Actions
- Deploy Wireshark 4.6.7 immediately on all analyst workstations and CI pipelines.
- Verify that third‑party extcap helpers are re‑packaged to the new
/usr/libexec/wireshark/extcaplocation. - Map the patched CVE‑like advisories to SOC 2 control evidence (change‑request tickets, patch‑approval logs).
- Incorporate the patch status into your continuous‑compliance dashboard for ongoing audit readiness.
Technical Notes — The flaws span parsers for Catapult DCT2000, SSH, IEEE 802.11, Z39.50, UMTS FP, pcapng, DBS Etherwatch, and others. Most are out‑of‑bounds reads or infinite‑loop conditions; one is an information‑disclosure via the BLF parser. No CVE identifiers were disclosed in the vendor advisory. Source: Help Net Security