An update for libpcap is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3989 Final 1.0 1.0 2026-09-20 Initial 2026-09-20 2026-09-20 openEuler SA Tool V1.0 2026-09-20 libpcap security update An update for libpcap is now available for openEuler-20.03-LTS-SP4 This is the official web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. Security Fix(es): In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.(CVE-2026-0799) The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.(CVE-2026-18238) rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.(CVE-2026-18313) libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.(CVE-2026-31911) libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.(CVE-2026-31912) libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.(CVE-2026-6244) libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.(CVE-2026-6554) An update for libpcap is now available for openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High libpcap https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-0799 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-18238 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-18313 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-31911 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-31912 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-6244 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-6554 https://nvd.nist.gov/vuln/detail/CVE-2026-0799 https://nvd.nist.gov/vuln/detail/CVE-2026-18238 https://nvd.nist.gov/vuln/detail/CVE-2026-18313 https://nvd.nist.gov/vuln/detail/CVE-2026-31911 https://nvd.nist.gov/vuln/detail/CVE-2026-31912 https://nvd.nist.gov/vuln/detail/CVE-2026-6244 https://nvd.nist.gov/vuln/detail/CVE-2026-6554 openEuler-20.03-LTS-SP4 libpcap-1.9.1-9.oe2003sp4.aarch64.rpm libpcap-debuginfo-1.9.1-9.oe2003sp4.aarch64.rpm libpcap-debugsource-1.9.1-9.oe2003sp4.aarch64.rpm libpcap-devel-1.9.1-9.oe2003sp4.aarch64.rpm libpcap-1.9.1-9.oe2003sp4.src.rpm libpcap-1.9.1-9.oe2003sp4.x86_64.rpm libpcap-debuginfo-1.9.1-9.oe2003sp4.x86_64.rpm libpcap-debugsource-1.9.1-9.oe2003sp4.x86_64.rpm libpcap-devel-1.9.1-9.oe2003sp4.x86_64.rpm libpcap-help-1.9.1-9.oe2003sp4.noarch.rpm In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures. 2026-09-20 CVE-2026-0799 openEuler-20.03-LTS-SP4 High 8.7 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H libpcap security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989 The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet. 2026-09-20 CVE-2026-18238 openEuler-20.03-LTS-SP4 Medium 5.0 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N libpcap security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989 rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster. 2026-09-20 CVE-2026-18313 openEuler-20.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L libpcap security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989 libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process. 2026-09-20 CVE-2026-31911 openEuler-20.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H libpcap security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989 libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures. 2026-09-20 CVE-2026-31912 openEuler-20.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H libpcap security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989 libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero. 2026-09-20 CVE-2026-6244 openEuler-20.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H libpcap security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989 libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely. 2026-09-20 CVE-2026-6554 openEuler-20.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H libpcap security update 2026-09-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3989