{"schema_version":"1.7.2","id":"OESA-2026-3991","modified":"2026-09-20T13:23:54Z","published":"2026-09-20T13:23:54Z","upstream":["CVE-2026-0799","CVE-2026-18238","CVE-2026-18313","CVE-2026-31911","CVE-2026-31912","CVE-2026-6244","CVE-2026-6554"],"summary":"libpcap security update","details":"This is the official web site of tcpdump, a powerful command-line  packet analyzer; and libpcap, a portable C/C++ library for  network traffic capture.\r\n\r\nSecurity Fix(es):\n\nIn BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.(CVE-2026-0799)\n\nThe rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.(CVE-2026-18238)\n\nrpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.(CVE-2026-18313)\n\nlibpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.(CVE-2026-31911)\n\nlibpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.(CVE-2026-31912)\n\nlibpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.(CVE-2026-6244)\n\nlibpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.(CVE-2026-6554)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"libpcap","purl":"pkg:rpm/openEuler/libpcap&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-6.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["libpcap-1.10.4-6.oe2403sp1.aarch64.rpm","libpcap-debuginfo-1.10.4-6.oe2403sp1.aarch64.rpm","libpcap-debugsource-1.10.4-6.oe2403sp1.aarch64.rpm","libpcap-devel-1.10.4-6.oe2403sp1.aarch64.rpm"],"noarch":["libpcap-help-1.10.4-6.oe2403sp1.noarch.rpm"],"src":["libpcap-1.10.4-6.oe2403sp1.src.rpm"],"x86_64":["libpcap-1.10.4-6.oe2403sp1.x86_64.rpm","libpcap-debuginfo-1.10.4-6.oe2403sp1.x86_64.rpm","libpcap-debugsource-1.10.4-6.oe2403sp1.x86_64.rpm","libpcap-devel-1.10.4-6.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3991"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0799"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18238"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18313"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31911"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31912"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6244"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6554"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H"}],"database_specific":{"severity":"High"}}