CVE-2019-9208

Name	CVE-2019-9208
Description	In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL pointer dereferences.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4416-1
Debian Bugs	923611

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wireshark (PTS)	jessie, jessie (lts)	1.12.1+g01b65bf-4+deb8u19	fixed
	stretch (security)	2.6.20-0+deb9u3	fixed
	stretch (lts), stretch	2.6.20-0+deb10u9~deb9u1	fixed
	buster, buster (lts)	2.6.20-0+deb10u9	fixed
	buster (security)	2.6.20-0+deb10u8	fixed
	bullseye	3.4.10-0+deb11u1	fixed
	bullseye (security)	3.4.16-0+deb11u1	fixed
	bookworm	4.0.17-0+deb12u1	fixed
	bookworm (security)	4.0.11-1~deb12u1	fixed
	sid, trixie	4.4.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
wireshark	source	wheezy	(not affected)
wireshark	source	jessie	(not affected)
wireshark	source	stretch	2.6.7-1~deb9u1	DSA-4416-1
wireshark	source	(unstable)	2.6.7-1		923611

Notes

[jessie] - wireshark <not-affected> (Vulnerable code not present)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15464
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3d1b8004ed3a07422ca5d4e4ee8097150b934fd2
https://www.wireshark.org/security/wnpa-sec-2019-07.html
[wheezy] - wireshark <not-affected> (vulnerable code is not present)