CVE-2019-9214
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was...
7.5 HighFix available
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
3.74%Up 1.5 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
CVE-2019-9214- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
CVE-2019-9214- Updated
- 2026-11-02
EUVDEUVD-2019-18589 No score
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
EUVD-2019-18589- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-87vf-6frx-g3h2
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was...
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
GHSA-87vf-6frx-g3h2- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-9214
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
ALPINE-CVE-2019-9214- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
CVE-2019-9214- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2019-9214
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
DEBIAN-CVE-2019-9214- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-9214
In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.
- Record
UBUNTU-CVE-2019-9214- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1108-1 No score
Security update for wireshark
This update for wireshark to version 2.4.13 fixes the following issues:
Security issues fixed:
- CVE-2019-9214: Avoided a dereference of a null coversation which could make RPCAP dissector crash (bsc#1127367).
- CVE-2019-9209: Fixed a buffer overflow in time values which could make ASN.1 BER and related dissectors crash (bsc#1127369).
- CVE-2019-9208: Fixed a null pointer dereference which could make TCAP dissector crash (bsc#1127370).
Release notes: https://www.wireshark.org/docs/relnotes/wireshark-2.4.13.html
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1108-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0362-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0362-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0619-1 No score
Security update for wireshark
This update for wireshark to version 2.4.13 fixes the following issues:
Security issues fixed:
- CVE-2019-9214: Avoided a dereference of a null coversation which could make RPCAP dissector crash (bsc#1127367).
- CVE-2019-9209: Fixed a buffer overflow in time values which could make ASN.1 BER and related dissectors crash (bsc#1127369).
- CVE-2019-9208: Fixed a null pointer dereference which could make TCAP dissector crash (bsc#1127370).
Release notes: https://www.wireshark.org/docs/relnotes/wireshark-2.4.13.html
- Record
SUSE-SU-2019:0619-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0688-1 No score
Security update for wireshark
This update for wireshark to version 2.4.13 fixes the following issues:
Security issues fixed:
- CVE-2019-9214: Avoided a dereference of a null coversation which could make RPCAP dissector crash (bsc#1127367).
- CVE-2019-9209: Fixed a buffer overflow in time values which could make ASN.1 BER and related dissectors crash (bsc#1127369).
- CVE-2019-9208: Fixed a null pointer dereference which could make TCAP dissector crash (bsc#1127370).
Release notes: https://www.wireshark.org/docs/relnotes/wireshark-2.4.13.html
- Record
SUSE-SU-2019:0688-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0693-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
- Record
SUSE-SU-2020:0693-1- Updated
- 2026-11-02
OSVUSN-3986-1 No score
Wireshark vulnerabilities
It was discovered that Wireshark improperly handled certain input. A remote or local attacker could cause Wireshark to crash by injecting malform packets onto the wire or convincing someone to read a malformed packet trace file.
- Record
USN-3986-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.10 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.11 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.12 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.13 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.14 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.15 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.16 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.17 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.18 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.19 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
Show 47 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkAlpine:v3.20 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.21 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.22 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.23 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.24 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkAlpine:v3.9 |
2.4.0 up to 2.6.7-r0 | 2.6.7-r0 |
wiresharkDebian:12 |
before 2.6.7-1 | 2.6.7-1 |
wiresharkDebian:13 |
before 2.6.7-1 | 2.6.7-1 |
wiresharkDebian:14 |
before 2.6.7-1 | 2.6.7-1 |
wiresharkDebian:9 From an advisory covering 7 CVEs |
before 2.6.7-1~deb9u1, plus listed versions 2.2.6+g32dac6a-22.2.6+g32dac6a-2+deb9u12.2.6+g32dac6a-2+deb9u22.2.6+g32dac6a-2+deb9u32.2.7-1 Show 17 moreShow less2.4.0-12.4.1-12.4.2-12.4.3-12.4.4-12.4.5-12.4.6-12.6.1-12.6.2-12.6.2-22.6.3-12.6.3-1~deb9u12.6.4-12.6.4-22.6.5-12.6.5-1~deb9u12.6.6-1 |
2.6.7-1~deb9u1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 3 CVEs |
before 2.4.13-3.22.1 | 2.4.13-3.22.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 3 CVEs |
before 2.4.13-3.22.1 | 2.4.13-3.22.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 3 CVEs |
before 2.4.13-48.42.1 | 2.4.13-48.42.1 |
libmaxminddbSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
spandspSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
wiresharkUbuntu:Pro:14.04:LTS |
before 2.6.8-1~ubuntu14.04.0~esm1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 5 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.0 |
2.6.8-1~ubuntu14.04.0~esm1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.8-1~ubuntu16.04.0, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 4 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.0 |
2.6.8-1~ubuntu16.04.0 |
wiresharkUbuntu:18.04:LTS |
before 2.6.8-1~ubuntu18.04.0, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.12.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.0 |
2.6.8-1~ubuntu18.04.0 |
wiresharkUbuntu:16.04:LTS From an advisory covering 9 CVEs |
before 2.6.8-1~ubuntu16.04.0, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 4 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.0 |
2.6.8-1~ubuntu16.04.0 |
wiresharkUbuntu:18.04:LTS From an advisory covering 9 CVEs |
before 2.6.8-1~ubuntu18.04.0, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.12.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.0 |
2.6.8-1~ubuntu18.04.0 |
wiresharkopenSUSE:Leap 15.0 From an advisory covering 3 CVEs |
before 2.4.13-lp150.2.23.1 | 2.4.13-lp150.2.23.1 |
libmaxminddbopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 1.4.2-lp151.3.3.1 | 1.4.2-lp151.3.3.1 |
spandspopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 0.0.6-lp151.3.3.1 | 0.0.6-lp151.3.3.1 |
wiresharkopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 3.2.2-lp151.2.9.1 | 3.2.2-lp151.2.9.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9214 is a high vulnerability (CVSS 7.5) in Wireshark, published February 27, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.74%, the 89th percentile. Fixed in wireshark 2.6.7-r0.
References
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15536
wireshark.org/security/wnpa-sec-2019-08.html
securityfocus.com/bid/107203
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c557bb0910be271e49563756411a690a1bc53ce5
debian.org/security/2019/dsa-4416
seclists.org/bugtraq/2019/Mar/35
Show 194 moreShow less
lists.opensuse.org/opensuse-security-announce/2019-04/msg00007.html
usn.ubuntu.com/3986-1
nvd.nist.gov/vuln/detail/CVE-2019-9214
github.com/advisories/GHSA-87vf-6frx-g3h2
security.alpinelinux.org/vuln/CVE-2019-9214
security-tracker.debian.org/tracker/CVE-2019-9214
suse.com/support/update/announcement/2019/suse-su-20190619-1
bugzilla.suse.com/1127367
ubuntu.com/security/CVE-2019-9214
cve.org/CVERecord?id=CVE-2019-9214
This page doesn't list everything
Left out here: 28 references. The JSON record has them.