Description
Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Tcpdump Group | libpcap | 1.9.x, 1.10.x – ≤ 1.10.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpcap | 1.10.5-1 | — |
| Debian 13 | libpcap | 1.10.5-1 | — |
| Debian 12 | libpcap | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | libpcap | 1.10.4-150600.3.3.2 | SUSE-SU-2024:3217-1 |
| SLES 15 SP5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLES 12 SP5 | libpcap | 1.8.1-10.6.1 | SUSE-SU-2024:3355-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | libpcap | 1.8.1-10.6.1 | SUSE-SU-2024:3355-1 |
| SLE Micro 6.1 | libpcap | 1.10.4-slfo.1.1_2.1 | SUSE-SU-2026:20064-1 |
| SLE Micro 6.0 | libpcap | 1.10.4-3.1 | SUSE-SU-2025:20059-1 |
| SLE Micro 5.5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLE Micro 5.4 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLE Micro 5.3 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
| SLE Micro 5.2 | libpcap | 1.9.1-150300.3.3.1 | SUSE-SU-2024:3516-1 |
| SLE Micro 5.1 | libpcap | 1.9.1-150300.3.3.1 | SUSE-SU-2024:3516-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libpcap | 1.10.5-1.1 | openSUSE-SU-2024:14309-1 |
| openSUSE Leap 15.6 | libpcap | 1.10.4-150600.3.3.2 | SUSE-SU-2024:3217-1 |
| openSUSE Leap 15.5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | libpcap | 1.10.1-150400.3.3.2 | SUSE-SU-2024:3210-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libpcap | 1.10.5-1 | — |
| Azure Linux 3 | nmap | 7.95-2 | — |
| Azure Linux 2 (CBL-Mariner) | libpcap | 1.10.1-3 | — |
| Azure Linux 2 (CBL-Mariner) | nmap | 7.93-3 | — |
Advisories 15
- WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2025-0148 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- SUSE-SU-2026:20064-1 Security update for libpcap SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20059-1 Security update for libpcap SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- SUSE-SU-2024:3516-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3355-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3210-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14309-1 libpcap-devel-1.10.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3217-1 Security update for libpcap SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- VDE-2025-053 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jul 8, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025