Download Wireshark 4.2.1

Version 4.2.1 of the open source protocol analyzer and packet sniffer Wireshark has been released. This program can be used to analyze various data packets and network protocols on the network. The program can also use previously saved data traffic as input. Wireshark can be downloaded for 64bit versions of Windows and macOS. The source code is available for use on Linux, Solaris and *BSD. In version 4.2.0 we find, among other things, a dark mode under Windows, there is a download for the Arm version of Windows and many protocols have been added or updated. The following changes and improvements have also been made in version 4.2.1:

The following vulnerabilities have been fixed:

• wnpa-sec-2024-01 GVCP dissector crash. Issue 19496. CVE-2024-0208.
• wnpa-sec-2024-02 IEEE 1609.2 dissector crash. Issue 19501. CVE-2024-0209.
• wnpa-sec-2024-03 HTTP3 dissector crash. Issue 19502. CVE-2024-0207.
• wnpa-sec-2024-04 Zigbee TLV dissector crash. Issue 19504. CVE-2024-0210.
• wnpa-sec-2024-05 DOCSIS dissector crash. Issue 19557. CVE-2024-0211.

The following bugs have been fixed:

• Capture filters not saved to recently used list. Issue 12918.
• CFM dissector does not handle Sender ID TLV correctly when Chassis ID Length is zero. Issue 13720.
• OSS-Fuzz 64290: wireshark:fuzzshark_ip: Global buffer overflow in dissect_zcl_read_attr_struct. Issue 19490.
• Overriding capture options set by preference by command line arguments (like -S) doesn't work. Issue 14549.
• Segfault when enabling monitor mode on wireless card that falsely claims to support it. Issue 16693.
• Documented format of temporary file name is out of date in the Wireshark User's Guide. Issue 18464.
• Selection highlight lost when interface list is sorted. Issue 19133.
• HTTP3 malformed packets. Issue 19475.
• Capture filter compilation fails with obscure error message. Issue 19480.
• XML: Parsing encoding attribute failed when standalone attribute exists. Issue 19485.
• Display filter expressions where the protocol name starts with digit and contains a hyphen are rejected. Issue 19489.
• diameter.3GPP-* display filters not working after upgrade to version 4.2.0. Issue 19493.
• GigE-vision: Control Protocol shows \”unknown\” as value for ASCII character set. Issue 19494.
• The HTTP/3 Request Header URI is not correct. Issue 19497.
• QUIC/TLS not extracting \”h3\” from ALPN in a capture. Issue 19503.
• Documentation on system requirements should be updated. Issue 19512.
• 4.2.0: init.lua in subdirectories not loaded anymore. Issue 19516.
• Malformed SIP/SDP messages: components are not decoded properly. Issue 19518.
• heuristic_protos do not reset on profile swap. Issue 19520.
• Wireshark 4.2 crashes on Apply As Column. Issue 19521.
• NFLOG timestamp is incorrect. Issue 19525.
• Qt6 Crash (Double Free) When Attempting to Save TCP Stream Graph. Issue 19529.
• Fixed parsing display filter expressions containing literal OID values, eg snmp.name == 1.3.6.1.2.1.1.3.0.

New and Updated Capture File Support

• pcapng: the if_tsoffset option is now supported.

The following downloads are available:
Wireshark 4.2.1 for Windows (64bit)
Wireshark 4.2.1 for Windows (Arm)
Wireshark 4.2.1 for Portable Apps
Wireshark 4.2.1 for macOS (Arm, 64bit)
Wireshark 4.2.1 for macOS (Intel, 64bit)
Wireshark 4.2.1 source code for Linux, Solaris and *BSD, among others