CVE-2019-10896
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was...
7.5 HighFix available
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
5.74%Up 3.3 points since Apr 14, 2021
What each source reports
NVD Score used
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- Record
CVE-2019-10896- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- Record
CVE-2019-10896- Updated
- 2026-11-02
EUVDEUVD-2019-2618 No score
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- Record
EUVD-2019-2618- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76g3-76v9-c96h
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was...
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- Record
GHSA-76g3-76v9-c96h- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- Record
CVE-2019-10896- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10896
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- Record
DEBIAN-CVE-2019-10896- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2019-10896
In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes.
- Record
UBUNTU-CVE-2019-10896- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1356-1 No score
Security update for wireshark
This update for wireshark to version 2.4.14 fixes the following issues:
Security issues fixed:
- CVE-2019-10895: NetScaler file parser crash.
- CVE-2019-10899: SRVLOC dissector crash.
- CVE-2019-10894: GSS-API dissector crash.
- CVE-2019-10896: DOF dissector crash.
- CVE-2019-10901: LDSS dissector crash.
- CVE-2019-10903: DCERPC SPOOLSS dissector crash.
Non-security issue fixed:
- Update to version 2.4.14 (bsc#1131945).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1356-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0362-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0362-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11513-1 No score
libwireshark14-3.4.8-1.2 on GA media
These are all security issues fixed in the libwireshark14-3.4.8-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11513-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1036-1 No score
Security update for wireshark
This update for wireshark to version 2.4.14 fixes the following issues:
Security issues fixed:
- CVE-2019-10895: NetScaler file parser crash.
- CVE-2019-10899: SRVLOC dissector crash.
- CVE-2019-10894: GSS-API dissector crash.
- CVE-2019-10896: DOF dissector crash.
- CVE-2019-10901: LDSS dissector crash.
- CVE-2019-10903: DCERPC SPOOLSS dissector crash.
Non-security issue fixed:
- Update to version 2.4.14 (bsc#1131945).
- Record
SUSE-SU-2019:1036-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1038-1 No score
Security update for wireshark
This update for wireshark to version 2.4.14 fixes the following issues:
Security issues fixed:
- CVE-2019-10895: NetScaler file parser crash.
- CVE-2019-10899: SRVLOC dissector crash.
- CVE-2019-10894: GSS-API dissector crash.
- CVE-2019-10896: DOF dissector crash.
- CVE-2019-10901: LDSS dissector crash.
- CVE-2019-10903: DCERPC SPOOLSS dissector crash.
Non-security issue fixed:
- Update to version 2.4.14 (bsc#1131945).
- Record
SUSE-SU-2019:1038-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0693-1 No score
Security update for wireshark
This update for wireshark and libmaxminddb fixes the following issues:
Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support (bsc#1156288).
New features include:
- Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC
- Improved support for existing protocols, like HTTP/2
- Improved analytics and usability functionalities
- Record
SUSE-SU-2020:0693-1- Updated
- 2026-11-02
OSVUSN-3986-1 No score
Wireshark vulnerabilities
It was discovered that Wireshark improperly handled certain input. A remote or local attacker could cause Wireshark to crash by injecting malform packets onto the wire or convincing someone to read a malformed packet trace file.
- Record
USN-3986-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wiresharkDebian:12 |
before 2.6.8-1 | 2.6.8-1 |
wiresharkDebian:13 |
before 2.6.8-1 | 2.6.8-1 |
wiresharkDebian:14 |
before 2.6.8-1 | 2.6.8-1 |
wiresharkDebian:9 From an advisory covering 7 CVEs |
before 2.6.8-1.1~deb9u1, plus listed versions 2.2.6+g32dac6a-22.2.6+g32dac6a-2+deb9u12.2.6+g32dac6a-2+deb9u22.2.6+g32dac6a-2+deb9u32.2.7-1 Show 20 moreShow less2.4.0-12.4.1-12.4.2-12.4.3-12.4.4-12.4.5-12.4.6-12.6.1-12.6.2-12.6.2-22.6.3-12.6.3-1~deb9u12.6.4-12.6.4-22.6.5-12.6.5-1~deb9u12.6.6-12.6.7-12.6.7-1~deb9u12.6.8-1 |
2.6.8-1.1~deb9u1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 6 CVEs |
before 2.4.14-3.25.2 | 2.4.14-3.25.2 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 6 CVEs |
before 2.4.14-3.25.2 | 2.4.14-3.25.2 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
Show 31 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wiresharkSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 6 CVEs |
before 2.4.14-48.45.1 | 2.4.14-48.45.1 |
libmaxminddbSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
spandspSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
libmaxminddbSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 1.4.2-1.3.1 | 1.4.2-1.3.1 |
spandspSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 0.0.6-3.2.1 | 0.0.6-3.2.1 |
wiresharkSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 59 CVEs |
before 3.2.2-3.35.2 | 3.2.2-3.35.2 |
wiresharkUbuntu:Pro:14.04:LTS |
before 2.6.8-1~ubuntu14.04.0~esm1, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 5 moreShow less1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.0 |
2.6.8-1~ubuntu14.04.0~esm1 |
wiresharkUbuntu:16.04:LTS |
before 2.6.8-1~ubuntu16.04.0, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 4 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.0 |
2.6.8-1~ubuntu16.04.0 |
wiresharkUbuntu:18.04:LTS |
before 2.6.8-1~ubuntu18.04.0, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.12.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.0 |
2.6.8-1~ubuntu18.04.0 |
wiresharkUbuntu:16.04:LTS From an advisory covering 9 CVEs |
before 2.6.8-1~ubuntu16.04.0, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 4 moreShow less2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.0 |
2.6.8-1~ubuntu16.04.0 |
wiresharkUbuntu:18.04:LTS From an advisory covering 9 CVEs |
before 2.6.8-1~ubuntu18.04.0, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.12.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.0 |
2.6.8-1~ubuntu18.04.0 |
wiresharkopenSUSE:Leap 15.0 From an advisory covering 6 CVEs |
before 2.4.14-lp150.2.26.3 | 2.4.14-lp150.2.26.3 |
libmaxminddbopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 1.4.2-lp151.3.3.1 | 1.4.2-lp151.3.3.1 |
spandspopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 0.0.6-lp151.3.3.1 | 0.0.6-lp151.3.3.1 |
wiresharkopenSUSE:Leap 15.1 From an advisory covering 59 CVEs |
before 3.2.2-lp151.2.9.1 | 3.2.2-lp151.2.9.1 |
wiresharkopenSUSE:Tumbleweed From an advisory covering 163 CVEs |
before 3.4.8-1.2 | 3.4.8-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10896 is a high vulnerability (CVSS 7.5) in Wireshark, published April 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.74%, the 93rd percentile. Fixed in wireshark 2.6.8-1.
References
wireshark.org/security/wnpa-sec-2019-15.html
bugs.wireshark.org/bugzilla/show_bug.cgi?id=15617
code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=441b6d9071d6341e58dfe10719375489c5b8e3f0
securityfocus.com/bid/107834
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R
Show 194 moreShow less
lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html
usn.ubuntu.com/3986-1
lists.debian.org/debian-lts-announce/2020/10/msg00036.html
nvd.nist.gov/vuln/detail/CVE-2019-10896
github.com/advisories/GHSA-76g3-76v9-c96h
security-tracker.debian.org/tracker/CVE-2019-10896
suse.com/support/update/announcement/2019/suse-su-20191036-1
bugzilla.suse.com/1131945
ubuntu.com/security/CVE-2019-10896
cve.org/CVERecord?id=CVE-2019-10896
This page doesn't list everything
Left out here: 30 references. The JSON record has them.