<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [

<!-- $Id: release-notes.xml 44504 2012-08-14 21:01:18Z gerald $ -->

<!--
DOCUMENT SECTION
-Use this section to encode all document information
-->

<!--
Wireshark Info
-->
<!ENTITY WiresharkCurrentVersion "1.6.10">

]>

<article>
  <title>Wireshark &WiresharkCurrentVersion; Release Notes</title>

  <section id="WhatIs"><title>What is Wireshark?</title>
    <para>
      Wireshark is the world's most popular network protocol analyzer.  It
      is used for troubleshooting, analysis, development and education.
    </para>
  </section>

  <section id="WhatsNew"><title>What's New</title>
    <section id="BugFixes"><title>Bug Fixes</title>

    <para>

      The following vulnerabilities have been fixed.
      <itemizedlist>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-13.html">wnpa-sec-2012-13</ulink>
          </para>
          <para>
	    The DCP ETSI dissector could trigger a zero division. Reported by
	    Laurent Butti.
            <!-- Fixed in trunk: r44247 -->
            <!-- Fixed in trunk-1.8: r44309 -->
            <!-- Fixed in trunk-1.6: r44310 -->
            <!-- Fixed in trunk-1.4: r44311 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7566">Bug
            7566</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4285">CVE-2012-4285</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-15.html">wnpa-sec-2012-15</ulink>
          </para>
          <para>
	    The XTP dissector could go into an infinite loop. Reported by Ben Schmidt.
            <!-- Fixed in trunk: r44289 -->
            <!-- Fixed in trunk-1.8: r44343 -->
            <!-- Fixed in trunk-1.6: r44344 -->
            <!-- Fixed in trunk-1.4: r44345 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7571">Bug
            7571</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4288">CVE-2012-4288</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-17.html">wnpa-sec-2012-17</ulink>
          </para>
          <para>
	    The AFP dissector could go into a large loop. Reported by Stefan Cornelius.
            <!-- Fixed in trunk: r44317 -->
            <!-- Fixed in trunk-1.8: r44349 -->
            <!-- Fixed in trunk-1.6: r44351 -->
            <!-- Fixed in trunk-1.4: r44352 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7603">Bug
            7603</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4289">CVE-2012-4289</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-18.html">wnpa-sec-2012-18</ulink>
          </para>
          <para>
	    The RTPS2 dissector could overflow a buffer. Reported by Laurent Butti.
            <!-- Fixed in trunk: r44320 -->
            <!-- Fixed in trunk-1.8: r44353 -->
            <!-- Fixed in trunk-1.6: r44354 -->
            <!-- Fixed in trunk-1.4: r44??? -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7568">Bug
            7568</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4296">CVE-2012-4296</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-19.html">wnpa-sec-2012-19</ulink>
          </para>
          <para>
	    The GSM RLC MAC dissector could overflow a buffer. Reported by Laurent Butti.
            <!-- Fixed in trunk: r44307, r44319 -->
            <!-- Fixed in trunk-1.8: r44356 -->
            <!-- Fixed in trunk-1.6: r44357 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7561">Bug
            7561</ulink>)
          </para>
          <para>Versions affected: 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4297">CVE-2012-4297</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-20.html">wnpa-sec-2012-20</ulink>
          </para>
          <para>
	    The CIP dissector could exhaust system memory. Reported by Ben Schmidt.
            <!-- Fixed in trunk: r44312 -->
            <!-- Fixed in trunk-1.8: r44360 -->
            <!-- Fixed in trunk-1.6: r44361 -->
            <!-- Fixed in trunk-1.4: r44362 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7570">Bug
            7570</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4291">CVE-2012-4291</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-21.html">wnpa-sec-2012-21</ulink>
          </para>
          <para>
	    The STUN dissector could crash. Reported by Laurent Butti.
            <!-- Fixed in trunk: r44366 -->
            <!-- Fixed in trunk-1.8: r44367 -->
            <!-- Fixed in trunk-1.6: r44368 -->
            <!-- Fixed in trunk-1.4: r44369 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7569">Bug
            7569</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4292">CVE-2012-4292</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-22.html">wnpa-sec-2012-22</ulink>
          </para>
          <para>
	    The EtherCAT Mailbox dissector could abort. Reported by Laurent Butti.
            <!-- Fixed in trunk: r43149 -->
            <!-- Fixed in trunk-1.8: r44389 -->
            <!-- Fixed in trunk-1.6: r44391 -->
            <!-- Fixed in trunk-1.4: r44392 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7562">Bug
            7562</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4293">CVE-2012-4293</ulink>
          </para>
        </listitem>

        <listitem>
          <para>
            <ulink url="http://www.wireshark.org/security/wnpa-sec-2012-23.html">wnpa-sec-2012-23</ulink>
          </para>
          <para>
	    The CTDB dissector could go into a large loop. Reported by Ben Schmidt.
            <!-- Fixed in trunk: r44403 -->
            <!-- Fixed in trunk-1.8: r44404 -->
            <!-- Fixed in trunk-1.6: r44405 -->
            <!-- Fixed in trunk-1.4: r44406 -->
            (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7573">Bug
            7573</ulink>)
          </para>
          <para>Versions affected: 1.4.0 to 1.4.14, 1.6.0 to 1.6.9, 1.8.0 to 1.8.1.</para>
          <para>
            <ulink url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4290">CVE-2012-4290</ulink>
          </para>
        </listitem>

      </itemizedlist>

    </para>

    <para>

    The following bugs have been fixed:

      <itemizedlist>

<!-- Sort by bug # -->
<!--
        <listitem><para>
	  Wireshark will ruin your favorite songs by singing them a capella,
	  loudly, and slightly off key.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=0000">Bug
          0000</ulink>)
        </para></listitem>
-->

        <listitem><para>
	  Wireshark may not run on Windows due to missing DLLs.
        </para></listitem>

        <listitem><para>
          ISDN LAPD  X.31 packet traffic can not be decoded.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7514">Bug
          7514</ulink>)
        </para></listitem>

        <listitem><para>
          GSM classmark3 decode wrong.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7524">Bug
          7524</ulink>)
        </para></listitem>

        <listitem><para>
          tshark WARNING ERR:   Dissector bug, protocol X2AP, in packet 17019451: proto.c:1347: failed assertion &quot;length == 4.
          (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7542">Bug
          7542</ulink>)
        </para></listitem>

     </itemizedlist>

    </para>

    </section>

    <section id="NewFeatures"><title>New and Updated Features</title>
    <para>

There are no new features in this release.

    </para>
    </section>

    <section id="NewProtocols"><title>New Protocol Support</title>
    <para>

There are no new protocols in this release.

    </para>
    </section>

    <section id="UpdatedProtocols"><title>Updated Protocol Support</title> <para>

<!-- Sort alphabetically -->

AFP,
CIP,
CTDB,
DCP ETSI,
EtherCAT Mailbox,
GSM A,
GSM RLC MAC,
ISDN,
NFS,
RTPS2,
STUN,
X2AP,
XTP

    </para>
    </section>

    <section id="NewCapture"><title>New and Updated Capture File Support</title>
    <para>

.

    </para>
    </section>

  </section>

  <section id="GettingWireshark"><title>Getting Wireshark</title>
    <para>
      Wireshark source code and installation packages are available from
      <ulink url="http://www.wireshark.org/download.html">http://www.wireshark.org/download.html</ulink>.
    </para>

    <section id="VendorPackages"><title>Vendor-supplied Packages</title>
      <para>
        Most Linux and Unix vendors supply their own Wireshark packages.
        You can usually install or upgrade Wireshark using the package management
        system specific to that platform.  A list of third-party packages
        can be found on the
        <ulink url="http://www.wireshark.org/download.html#thirdparty">download page</ulink>
        on the Wireshark web site.
      </para>
    </section>

  </section>

  <!-- XXX needs to be written
  <section id="RemovingWireshark"><title>Removing Wireshark</title>
    <para>
    </para>
  </section>
  -->

  <section id="FileLocations"><title>File Locations</title>
    <para>
      Wireshark and TShark look in several different locations for
      preference files, plugins, SNMP MIBS, and RADIUS dictionaries.
      These locations vary from platform to platform.  You can use
      About→Folders to find the default locations on your system.
    </para>
  </section>

  <section id="KnownProblems"><title>Known Problems</title>

    <para>
      Wireshark might make your system disassociate from a wireless network
      on OS X 10.4.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1315">Bug
      1315</ulink>)
    </para>

    <para>
      Dumpcap might not quit if Wireshark or TShark crashes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1419">Bug
      1419</ulink>)
    </para>

    <para>
      The BER dissector might infinitely loop.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1516">Bug
      1516</ulink>)
    </para>

    <para>
      Capture filters aren't applied when capturing from named pipes.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1814">Bug
      1814</ulink>)
    </para>

    <para>
      Filtering tshark captures with display filters (-R) no longer works.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2234">Bug
      2234</ulink>)
    </para>

    <para>
      The 64-bit Windows installer does not ship with libsmi.
      (<ulink url="http://wiki.wireshark.org/Development/Win64">Win64
      development page</ulink>)
    </para>

    <para>
      &quot;Closing File!&quot; Dialog Hangs.
      (<ulink url="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3046">Bug
      3046</ulink>)
    </para>

    <para>
      Application crash when changing real-time option.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4035">Bug
      4035</ulink>)
    </para>

    <para>
      Hex pane display issue after startup.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4056">Bug
      4056</ulink>)
    </para>

    <para>
      Packet list rows are oversized.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4357">Bug
      4357</ulink>)
    </para>

    <para>
      Summary pane selected frame highlighting not maintained.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4445">Bug
      4445</ulink>)
    </para>

    <para>
      Wireshark and TShark will display incorrect delta times when displayed as
      a custom column.
      (<ulink url="http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4985">Bug
      4985</ulink>)
    </para>

  </section>

  <section id="GettingHelp"><title>Getting Help</title>
    <para>
    Community support is available on
    <ulink url="http://ask.wireshark.org/">Wireshark's Q&amp;A site</ulink>
    and on the wireshark-users mailing list.
    Subscription information and archives for all of Wireshark's mailing
    lists can be found on <ulink url="http://www.wireshark.org/lists/">the
    web site</ulink>.
    </para>
    <para>
    Official Wireshark training and certification are available from
    <ulink url="http://www.wiresharktraining.com/">Wireshark University</ulink>.
    </para>
  </section>

  <section id="FAQ"><title>Frequently Asked Questions</title>
    <para>
    A complete FAQ is available on the
    <ulink url="http://www.wireshark.org/faq.html">Wireshark web site</ulink>.
    </para>
  </section>

</article>
