Description
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Tcpdump Group | libpcap | 1.8.x, 1.9.x, 1.10.x – ≤ 1.10.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpcap | 1.10.5-1 | — |
| Debian 13 | libpcap | 1.10.5-1 | — |
| Debian 12 | libpcap | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | libpcap | 1.10.4-150600.3.3.2 | SUSE-SU-2024:3217-1 |
| SLES 15 SP5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLES 12 SP5 | libpcap | 1.8.1-10.6.1 | SUSE-SU-2024:3355-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | libpcap | 1.8.1-10.6.1 | SUSE-SU-2024:3355-1 |
| SLE Micro 6.1 | libpcap | 1.10.4-slfo.1.1_2.1 | SUSE-SU-2026:20064-1 |
| SLE Micro 6.0 | libpcap | 1.10.4-3.1 | SUSE-SU-2025:20059-1 |
| SLE Micro 5.5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLE Micro 5.4 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLE Micro 5.3 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLE Micro 5.2 | libpcap | 1.9.1-150300.3.3.1 | SUSE-SU-2024:3516-1 |
| SLE Micro 5.1 | libpcap | 1.9.1-150300.3.3.1 | SUSE-SU-2024:3516-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libpcap | 1.10.5-1.1 | openSUSE-SU-2024:14309-1 |
| openSUSE Leap 15.6 | libpcap | 1.10.4-150600.3.3.2 | SUSE-SU-2024:3217-1 |
| openSUSE Leap 15.5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libpcap | 1.10.5-1 | — |
| Azure Linux 3 | nmap | 7.95-2 | — |
| Azure Linux 2 (CBL-Mariner) | libpcap | 1.10.1-4 | — |
| Azure Linux 2 (CBL-Mariner) | nmap | 7.93-3 | — |
Advisories 11
- SUSE-SU-2026:20064-1 Security update for libpcap SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20059-1 Security update for libpcap SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- SUSE-SU-2024:3516-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3355-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3210-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14309-1 libpcap-devel-1.10.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3217-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2025-053 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jul 8, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025