Security update for libpcap
This update for libpcap fixes the following issues: - CVE-2026-0799: the BPF interpreter does not validate values in BPF instructions that load/store a value from/to a scratch memory register and allows for OOB access (bsc#1279782). - CVE-2026-6244: libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero (bsc#1279595). - CVE-2026-6554: libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction implements looping via backward jumps, but it does not limit the number of loop iterations. Can cause infinite loop (bsc#1279584). - CVE-2026-18238: `rpcap` client code that processes a `RPCAP_MSG_PACKET` message received from the server incorrectly validates its headers and allows for an OOB access (bsc#1279783). - CVE-2026-18313: `rpcapd` allocates up to 65536 bytes per each `RPCAP_MSG_UPDATEFILTER_REQ` or `RPCAP_MSG_STARTCAP_REQ` message received from the client and never frees the memory (bsc#1279784). - CVE-2026-31911: libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process (bsc#1279588). - CVE-2026-31912: libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates
SUSE-SU-2026:23907-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23907-1
libpcap
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.10.5-160000.5.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
libpcap
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.10.5-160000.5.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.5-160000.5.1"
}
]
}
],
"package": {
"name": "libpcap",
"purl": "pkg:rpm/suse/libpcap&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23907-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libpcap1": "1.10.5-160000.5.1",
"libpcap-devel": "1.10.5-160000.5.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.5-160000.5.1"
}
]
}
],
"package": {
"name": "libpcap",
"purl": "pkg:rpm/suse/libpcap&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23907-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libpcap1": "1.10.5-160000.5.1",
"libpcap-devel": "1.10.5-160000.5.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #46743 · Revision 1
- Added to Heist Feed
- Publisher date