CVE-2019-10895
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash....
7.5 HighFix available
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
5.80%Up 2.7 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
CVE-2019-10895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
CVE-2019-10895- Updated
- 2026-11-02
EUVDEUVD-2019-2617 No score
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
EUVD-2019-2617- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4cxv-gmm7-q86r
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash....
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
GHSA-4cxv-gmm7-q86r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-10895
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
ALPINE-CVE-2019-10895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
CVE-2019-10895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2019-10895
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
DEBIAN-CVE-2019-10895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10895
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation.
- Record
UBUNTU-CVE-2019-10895- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1356-1 No score
Security update for wireshark
This update for wireshark to version 2.4.14 fixes the following issues:
Security issues fixed:
- CVE-2019-10895: NetScaler file parser crash.
- CVE-2019-10899: SRVLOC dissector crash.
- CVE-2019-10894: GSS-API dissector crash.
- CVE-2019-10896: DOF dissector crash.
- CVE-2019-10901: LDSS dissector crash.
- CVE-2019-10903: DCERPC SPOOLSS dissector crash.
Non-security issue fixed:
- Update to version 2.4.14 (bsc#1131945).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1356-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0362-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0362-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1036-1 No score
Security update for wireshark
This update for wireshark to version 2.4.14 fixes the following issues:
Security issues fixed:
- CVE-2019-10895: NetScaler file parser crash.
- CVE-2019-10899: SRVLOC dissector crash.
- CVE-2019-10894: GSS-API dissector crash.
- CVE-2019-10896: DOF dissector crash.
- CVE-2019-10901: LDSS dissector crash.
- CVE-2019-10903: DCERPC SPOOLSS dissector crash.
Non-security issue fixed:
- Update to version 2.4.14 (bsc#1131945).
- Record
SUSE-SU-2019:1036-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1038-1 No score
Security update for wireshark
This update for wireshark to version 2.4.14 fixes the following issues:
Security issues fixed:
- CVE-2019-10895: NetScaler file parser crash.
- CVE-2019-10899: SRVLOC dissector crash.
- CVE-2019-10894: GSS-API dissector crash.
- CVE-2019-10896: DOF dissector crash.
- CVE-2019-10901: LDSS dissector crash.
- CVE-2019-10903: DCERPC SPOOLSS dissector crash.
Non-security issue fixed:
- Update to version 2.4.14 (bsc#1131945).
- Record
SUSE-SU-2019:1038-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0693-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
- Record
SUSE-SU-2020:0693-1- Updated
- 2026-11-02
OSVUSN-3986-1 No score
Wireshark vulnerabilities
It was discovered that Wireshark improperly handled certain input. A remote or local attacker could cause Wireshark to crash by injecting malform packets onto the wire or convincing someone to read a malformed packet trace file.
- Record
USN-3986-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.10 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.11 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.12 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.13 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.14 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.15 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.16 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.17 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.18 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.19 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
Show 48 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.20 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.21 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.22 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.23 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.24 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkAlpine:v3.9 |
2.4.0 up to 2.6.8-r0 | 2.6.8-r0 |
wiresharkDebian:12 |
before 2.6.8-1 | 2.6.8-1 |
wiresharkDebian:13 |
before 2.6.8-1 | 2.6.8-1 |
wiresharkDebian:14 |
before 2.6.8-1 | 2.6.8-1 |
wiresharkDebian:8 From an advisory covering 5 CVEs |
before 1.12.1+g01b65bf-4+deb8u19, plus listed versions 1.12.1+g01b65bf-41.12.1+g01b65bf-4+deb8u11.12.1+g01b65bf-4+deb8u101.12.1+g01b65bf-4+deb8u111.12.1+g01b65bf-4+deb8u12 Show 25 moreShow less1.12.1+g01b65bf-4+deb8u131.12.1+g01b65bf-4+deb8u141.12.1+g01b65bf-4+deb8u151.12.1+g01b65bf-4+deb8u161.12.1+g01b65bf-4+deb8u171.12.1+g01b65bf-4+deb8u181.12.1+g01b65bf-4+deb8u21.12.1+g01b65bf-4+deb8u31.12.1+g01b65bf-4+deb8u41.12.1+g01b65bf-4+deb8u51.12.1+g01b65bf-4+deb8u61.12.1+g01b65bf-4+deb8u6~deb7u11.12.1+g01b65bf-4+deb8u6~deb7u101.12.1+g01b65bf-4+deb8u6~deb7u111.12.1+g01b65bf-4+deb8u6~deb7u21.12.1+g01b65bf-4+deb8u6~deb7u31.12.1+g01b65bf-4+deb8u6~deb7u41.12.1+g01b65bf-4+deb8u6~deb7u51.12.1+g01b65bf-4+deb8u6~deb7u61.12.1+g01b65bf-4+deb8u6~deb7u71.12.1+g01b65bf-4+deb8u6~deb7u81.12.1+g01b65bf-4+deb8u6~deb7u91.12.1+g01b65bf-4+deb8u71.12.1+g01b65bf-4+deb8u81.12.1+g01b65bf-4+deb8u9 |
1.12.1+g01b65bf-4+deb8u19 |
wiresharkDebian:9 From an advisory covering 7 CVEs |
before 2.6.8-1.1~deb9u1, plus listed versions 2.2.6+g32dac6a-22.2.6+g32dac6a-2+deb9u12.2.6+g32dac6a-2+deb9u22.2.6+g32dac6a-2+deb9u32.2.7-1 Show 20 moreShow less2.4.0-12.4.1-12.4.2-12.4.3-12.4.4-12.4.5-12.4.6-12.6.1-12.6.2-12.6.2-22.6.3-12.6.3-1~deb9u12.6.4-12.6.4-22.6.5-12.6.5-1~deb9u12.6.6-12.6.7-12.6.7-1~deb9u12.6.8-1 |
2.6.8-1.1~deb9u1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 6 CVEs |
before 2.4.14-3.25.2 | 2.4.14-3.25.2 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 6 CVEs |
before 2.4.14-3.25.2 | 2.4.14-3.25.2 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
libmaxminddbSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
spandspSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
wiresharkUbuntu:Pro:14.04:LTS |
before 2.6.8-1~ubuntu14.04.0~esm1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 5 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.0 |
2.6.8-1~ubuntu14.04.0~esm1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.8-1~ubuntu16.04.0, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 4 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.0 |
2.6.8-1~ubuntu16.04.0 |
wiresharkUbuntu:18.04:LTS |
before 2.6.8-1~ubuntu18.04.0, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.12.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.0 |
2.6.8-1~ubuntu18.04.0 |
wiresharkUbuntu:16.04:LTS From an advisory covering 9 CVEs |
before 2.6.8-1~ubuntu16.04.0, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 4 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.0 |
2.6.8-1~ubuntu16.04.0 |
wiresharkUbuntu:18.04:LTS From an advisory covering 9 CVEs |
before 2.6.8-1~ubuntu18.04.0, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.12.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.0 |
2.6.8-1~ubuntu18.04.0 |
wiresharkopenSUSE:Leap 15.0 From an advisory covering 6 CVEs |
before 2.4.14-lp150.2.26.3 | 2.4.14-lp150.2.26.3 |
libmaxminddbopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 1.4.2-lp151.3.3.1 | 1.4.2-lp151.3.3.1 |
spandspopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 0.0.6-lp151.3.3.1 | 0.0.6-lp151.3.3.1 |
wiresharkopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 3.2.2-lp151.2.9.1 | 3.2.2-lp151.2.9.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10895 is a high vulnerability (CVSS 7.5) in Wireshark, published April 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.80%, the 93rd percentile. Fixed in wireshark 2.6.8-r0.
References
wireshark.org/security/wnpa-sec-2019-09.html
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15497
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=cab0cff6abdd7a5b5b0bfa4ee204eea951e129e9
securityfocus.com/bid/107834
Show 194 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R
lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html
usn.ubuntu.com/3986-1
lists.debian.org/debian-lts-announce/2019/05/msg00034.html
nvd.nist.gov/vuln/detail/CVE-2019-10895
github.com/advisories/GHSA-4cxv-gmm7-q86r
security.alpinelinux.org/vuln/CVE-2019-10895
security-tracker.debian.org/tracker/CVE-2019-10895
suse.com/support/update/announcement/2019/suse-su-20191036-1
bugzilla.suse.com/1131945
ubuntu.com/security/CVE-2019-10895
cve.org/CVERecord?id=CVE-2019-10895
This page doesn't list everything
Left out here: 36 references. The JSON record has them.