CVE-2026-6554 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the… |
CVE-2026-6244 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a… |
CVE-2026-31912 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with… |
CVE-2026-31911 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program… |
CVE-2026-18313 | Medium | 4.3 | 2026-09-05 | rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the me… |
CVE-2026-18238 | Medium | 5.0 | 2026-09-05 | The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a craf… |
CVE-2026-0799 | High | 8.7 | 2026-09-05 | In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libp… |
CVE-2025-11964 | Low | 1.9 | 2025-12-31 | On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le… |
CVE-2025-11961 | Low | 1.9 | 2025-12-31 | pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a wel… |
CVE-2024-8006 | Medium | 4.4 | 2024-08-31 | Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions t… |
CVE-2023-7256 | Medium | 4.4 | 2024-08-31 | In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo… |
CVE-2024-2397 | Medium | 6.2 | 2024-04-12 | Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL .pcap savefile. Th… |
CVE-2023-1801 | Medium | 6.5 | 2023-04-07 | The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet. |
CVE-2021-41043 | Medium | 5.5 | 2022-01-05 | Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact. |
CVE-2020-8037 | High | 7.5 | 2020-11-04 | The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. |
CVE-2020-8036 | High | 7.5 | 2020-11-04 | The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way. |
CVE-2018-16301 | High | 7.8 | 2019-10-03 | The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to… |