Search criteria
8 vulnerabilities found for libpcap by The Tcpdump Group
CVE-2025-11961 (GCVE-0-2025-11961)
Vulnerability from nvd – Published: 2025-12-31 00:56 – Updated: 2026-01-02 14:38
VLAI?
Title
OOBR and OOBW in pcap_ether_aton() in libpcap
Summary
pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.
Severity ?
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
0 , < 1.10.6
(semver)
|
Credits
Jin Wei
Kunwei Qian
Ping Chen
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-02T14:23:09.479384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T14:38:16.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libpcap",
"programFiles": [
"nametoaddr.c"
],
"programRoutines": [
{
"name": "pcap_ether_aton()"
}
],
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"lessThan": "1.10.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jin Wei"
},
{
"lang": "en",
"type": "reporter",
"value": "Kunwei Qian"
},
{
"lang": "en",
"type": "reporter",
"value": "Ping Chen"
}
],
"descriptions": [
{
"lang": "en",
"value": "pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126 Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-31T00:56:16.310Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/b2d2f9a9a0581c40780bde509f7cc715920f1c02"
}
],
"solutions": [
{
"lang": "en",
"value": "In libpcap 1.10.6 the function has been reimplemented to apply a stricter input validation and to fail safely if the input is invalid."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OOBR and OOBW in pcap_ether_aton() in libpcap"
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2025-11961",
"datePublished": "2025-12-31T00:56:16.310Z",
"dateReserved": "2025-10-20T13:42:36.190Z",
"dateUpdated": "2026-01-02T14:38:16.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11964 (GCVE-0-2025-11964)
Vulnerability from nvd – Published: 2025-12-31 00:58 – Updated: 2026-01-02 14:38
VLAI?
Title
OOBW in utf_16le_to_utf_8_truncated() in libpcap
Summary
On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.
Severity ?
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
1.10.0 , < 1.10.6
(semver)
|
Credits
Aniruddhan Murali
Noble Saji Mathews
Mahmoud Alfadel
Mei Nagappan
Meng Xu
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-02T14:23:03.611964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T14:38:10.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libpcap",
"programFiles": [
"fmtutils.c"
],
"programRoutines": [
{
"name": "utf_16le_to_utf_8_truncated()"
}
],
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"lessThan": "1.10.6",
"status": "affected",
"version": "1.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Aniruddhan Murali"
},
{
"lang": "en",
"type": "reporter",
"value": "Noble Saji Mathews"
},
{
"lang": "en",
"type": "reporter",
"value": "Mahmoud Alfadel"
},
{
"lang": "en",
"type": "reporter",
"value": "Mei Nagappan"
},
{
"lang": "en",
"type": "reporter",
"value": "Meng Xu"
}
],
"descriptions": [
{
"lang": "en",
"value": "On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-31T00:58:19.026Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/7fabf607f2319a36a0bd78444247180acb838e69"
}
],
"solutions": [
{
"lang": "en",
"value": "libpcap 1.10.6 includes a fix for this bug."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OOBW in utf_16le_to_utf_8_truncated() in libpcap"
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2025-11964",
"datePublished": "2025-12-31T00:58:19.026Z",
"dateReserved": "2025-10-20T14:43:15.180Z",
"dateUpdated": "2026-01-02T14:38:10.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8006 (GCVE-0-2024-8006)
Vulnerability from nvd – Published: 2024-08-30 23:53 – Updated: 2024-09-03 19:17
VLAI?
Title
NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support
Summary
Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.
Severity ?
4.4 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
1.9.x
Affected: 1.10.x , ≤ 1.10.4 (semver) |
Credits
Flavio Toffalini
Nicolas Badoux
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T19:17:39.415802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T19:17:49.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"remote packet capture"
],
"product": "libpcap",
"programRoutines": [
{
"name": "pcap_findalldevs_ex()"
}
],
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"status": "affected",
"version": "1.9.x"
},
{
"lessThanOrEqual": "1.10.4",
"status": "affected",
"version": "1.10.x",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "The problem is specific to the remote packet capture code, which is not enabled in the default build configuration."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Flavio Toffalini"
},
{
"lang": "en",
"type": "reporter",
"value": "Nicolas Badoux"
}
],
"descriptions": [
{
"lang": "en",
"value": "Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence."
}
],
"exploits": [
{
"lang": "en",
"value": "A functional exploit exists."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-30T23:53:11.334Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/0f8a103469ce87d2b8d68c5130a46ddb7fb5eb29"
},
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/8a633ee5b9ecd9d38a587ac9b204e2380713b0d6"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to libpcap 1.10.5."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support",
"workarounds": [
{
"lang": "en",
"value": "Do not build libpcap with remote packet capture support."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2024-8006",
"datePublished": "2024-08-30T23:53:11.334Z",
"dateReserved": "2024-08-20T09:58:58.455Z",
"dateUpdated": "2024-09-03T19:17:49.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-7256 (GCVE-0-2023-7256)
Vulnerability from nvd – Published: 2024-08-30 23:44 – Updated: 2024-09-03 20:07
VLAI?
Title
Double-free in libpcap before 1.10.5 with remote packet capture support.
Summary
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Severity ?
4.4 (Medium)
CWE
- CWE-415 - Double Free
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
1.8.x
Affected: 1.9.x Affected: 1.10.x , ≤ 1.10.4 (semver) |
Credits
Dora Sweet
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T20:03:11.759531Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T20:07:34.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"remote packet capture"
],
"product": "libpcap",
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"status": "affected",
"version": "1.8.x"
},
{
"status": "affected",
"version": "1.9.x"
},
{
"lessThanOrEqual": "1.10.4",
"status": "affected",
"version": "1.10.x",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "The problem is specific to the remote packet capture code, which is not enabled in the default build configuration."
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dora Sweet"
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400."
}
],
"exploits": [
{
"lang": "en",
"value": "A functional exploit exists."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-30T23:44:04.383Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/262e4f34979872d822ccedf9f318ed89c4d31c03"
},
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/2aa69b04d8173b18a0e3492e0c8f2f7fabdf642d"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to libpcap 1.10.5."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Double-free in libpcap before 1.10.5 with remote packet capture support.",
"workarounds": [
{
"lang": "en",
"value": "Do not build libpcap with remote packet capture support."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2023-7256",
"datePublished": "2024-08-30T23:44:04.383Z",
"dateReserved": "2024-04-11T15:02:51.577Z",
"dateUpdated": "2024-09-03T20:07:34.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-11964 (GCVE-0-2025-11964)
Vulnerability from cvelistv5 – Published: 2025-12-31 00:58 – Updated: 2026-01-02 14:38
VLAI?
Title
OOBW in utf_16le_to_utf_8_truncated() in libpcap
Summary
On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.
Severity ?
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
1.10.0 , < 1.10.6
(semver)
|
Credits
Aniruddhan Murali
Noble Saji Mathews
Mahmoud Alfadel
Mei Nagappan
Meng Xu
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11964",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-02T14:23:03.611964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T14:38:10.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libpcap",
"programFiles": [
"fmtutils.c"
],
"programRoutines": [
{
"name": "utf_16le_to_utf_8_truncated()"
}
],
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"lessThan": "1.10.6",
"status": "affected",
"version": "1.10.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Aniruddhan Murali"
},
{
"lang": "en",
"type": "reporter",
"value": "Noble Saji Mathews"
},
{
"lang": "en",
"type": "reporter",
"value": "Mahmoud Alfadel"
},
{
"lang": "en",
"type": "reporter",
"value": "Mei Nagappan"
},
{
"lang": "en",
"type": "reporter",
"value": "Meng Xu"
}
],
"descriptions": [
{
"lang": "en",
"value": "On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-31T00:58:19.026Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/7fabf607f2319a36a0bd78444247180acb838e69"
}
],
"solutions": [
{
"lang": "en",
"value": "libpcap 1.10.6 includes a fix for this bug."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OOBW in utf_16le_to_utf_8_truncated() in libpcap"
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2025-11964",
"datePublished": "2025-12-31T00:58:19.026Z",
"dateReserved": "2025-10-20T14:43:15.180Z",
"dateUpdated": "2026-01-02T14:38:10.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11961 (GCVE-0-2025-11961)
Vulnerability from cvelistv5 – Published: 2025-12-31 00:56 – Updated: 2026-01-02 14:38
VLAI?
Title
OOBR and OOBW in pcap_ether_aton() in libpcap
Summary
pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.
Severity ?
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
0 , < 1.10.6
(semver)
|
Credits
Jin Wei
Kunwei Qian
Ping Chen
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-02T14:23:09.479384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T14:38:16.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libpcap",
"programFiles": [
"nametoaddr.c"
],
"programRoutines": [
{
"name": "pcap_ether_aton()"
}
],
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"lessThan": "1.10.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jin Wei"
},
{
"lang": "en",
"type": "reporter",
"value": "Kunwei Qian"
},
{
"lang": "en",
"type": "reporter",
"value": "Ping Chen"
}
],
"descriptions": [
{
"lang": "en",
"value": "pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126 Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-31T00:56:16.310Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/b2d2f9a9a0581c40780bde509f7cc715920f1c02"
}
],
"solutions": [
{
"lang": "en",
"value": "In libpcap 1.10.6 the function has been reimplemented to apply a stricter input validation and to fail safely if the input is invalid."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OOBR and OOBW in pcap_ether_aton() in libpcap"
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2025-11961",
"datePublished": "2025-12-31T00:56:16.310Z",
"dateReserved": "2025-10-20T13:42:36.190Z",
"dateUpdated": "2026-01-02T14:38:16.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-8006 (GCVE-0-2024-8006)
Vulnerability from cvelistv5 – Published: 2024-08-30 23:53 – Updated: 2024-09-03 19:17
VLAI?
Title
NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support
Summary
Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.
Severity ?
4.4 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
1.9.x
Affected: 1.10.x , ≤ 1.10.4 (semver) |
Credits
Flavio Toffalini
Nicolas Badoux
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T19:17:39.415802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T19:17:49.301Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"remote packet capture"
],
"product": "libpcap",
"programRoutines": [
{
"name": "pcap_findalldevs_ex()"
}
],
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"status": "affected",
"version": "1.9.x"
},
{
"lessThanOrEqual": "1.10.4",
"status": "affected",
"version": "1.10.x",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "The problem is specific to the remote packet capture code, which is not enabled in the default build configuration."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Flavio Toffalini"
},
{
"lang": "en",
"type": "reporter",
"value": "Nicolas Badoux"
}
],
"descriptions": [
{
"lang": "en",
"value": "Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence."
}
],
"exploits": [
{
"lang": "en",
"value": "A functional exploit exists."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-30T23:53:11.334Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/0f8a103469ce87d2b8d68c5130a46ddb7fb5eb29"
},
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/8a633ee5b9ecd9d38a587ac9b204e2380713b0d6"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to libpcap 1.10.5."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support",
"workarounds": [
{
"lang": "en",
"value": "Do not build libpcap with remote packet capture support."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2024-8006",
"datePublished": "2024-08-30T23:53:11.334Z",
"dateReserved": "2024-08-20T09:58:58.455Z",
"dateUpdated": "2024-09-03T19:17:49.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-7256 (GCVE-0-2023-7256)
Vulnerability from cvelistv5 – Published: 2024-08-30 23:44 – Updated: 2024-09-03 20:07
VLAI?
Title
Double-free in libpcap before 1.10.5 with remote packet capture support.
Summary
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Severity ?
4.4 (Medium)
CWE
- CWE-415 - Double Free
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Tcpdump Group | libpcap |
Affected:
1.8.x
Affected: 1.9.x Affected: 1.10.x , ≤ 1.10.4 (semver) |
Credits
Dora Sweet
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-7256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-03T20:03:11.759531Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-03T20:07:34.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"remote packet capture"
],
"product": "libpcap",
"repo": "https://github.com/the-tcpdump-group/libpcap/",
"vendor": "The Tcpdump Group",
"versions": [
{
"status": "affected",
"version": "1.8.x"
},
{
"status": "affected",
"version": "1.9.x"
},
{
"lessThanOrEqual": "1.10.4",
"status": "affected",
"version": "1.10.x",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "The problem is specific to the remote packet capture code, which is not enabled in the default build configuration."
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dora Sweet"
}
],
"descriptions": [
{
"lang": "en",
"value": "In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400."
}
],
"exploits": [
{
"lang": "en",
"value": "A functional exploit exists."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-30T23:44:04.383Z",
"orgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"shortName": "Tcpdump"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/262e4f34979872d822ccedf9f318ed89c4d31c03"
},
{
"tags": [
"patch"
],
"url": "https://github.com/the-tcpdump-group/libpcap/commit/2aa69b04d8173b18a0e3492e0c8f2f7fabdf642d"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to libpcap 1.10.5."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Double-free in libpcap before 1.10.5 with remote packet capture support.",
"workarounds": [
{
"lang": "en",
"value": "Do not build libpcap with remote packet capture support."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cfdbb673-b408-4d03-89c1-c3d73ed80896",
"assignerShortName": "Tcpdump",
"cveId": "CVE-2023-7256",
"datePublished": "2024-08-30T23:44:04.383Z",
"dateReserved": "2024-04-11T15:02:51.577Z",
"dateUpdated": "2024-09-03T20:07:34.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}