Your message dated Tue, 08 Sep 2026 15:21:49 +0000
with message-id <[email protected]>
and subject line Bug#1146825: fixed in libpcap 1.10.7-1
has caused the Debian Bug report #1146825,
regarding libpcap: CVE-2026-0799 CVE-2026-18238 CVE-2026-18313 CVE-2026-31911
CVE-2026-31912 CVE-2026-6244 CVE-2026-6554
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146825: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146825
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libpcap
Version: 1.10.6-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for libpcap.
CVE-2026-0799[0]:
| In BPF instructions that load/store a value from/to a scratch memory
| register the register index is an unsigned 32-bit integer and must
| not exceed 15, but libpcap BPF interpreter does not validate the
| value. In particular uncommon use cases a crafted filter program
| can cause the interpreter to try reading and writing the OS process
| memory in the 16GiB starting at the current stack frame on 64-bit
| architectures and in the entire address space on 32-bit
| architectures.
CVE-2026-18238[1]:
| The rpcap client code that processes a RPCAP_MSG_PACKET message
| received from the server incorrectly validates its headers. A
| malicious server can send a crafted message and cause the client to
| treat up to 20 bytes of the client process memory beyond the end of
| the buffer as if it was a part of the captured packet.
CVE-2026-18313[2]:
| rpcapd can allocate up to 65536 bytes per each
| RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message
| received from the client, but it never frees the memory, so it leaks
| memory even under normal use. A malicious client can cause the
| server to leak memory substantially faster.
CVE-2026-31911[3]:
| libpcap BPF interpreter calls abort() if it encounters a BPF
| instruction that has an invalid opcode. In particular uncommon use
| cases a crafted filter program can terminate the OS process.
CVE-2026-31912[4]:
| libpcap BPF interpreter detects neither reaching the end of the
| filter program buffer due to lack of a return instruction nor
| executing a jump instruction with an offset that translates to a
| pointer outside of the buffer. In particular uncommon use cases a
| crafted filter program can cause the interpreter to try reading the
| OS process memory in the 32GiB around the buffer on 64-bit
| architectures and in the entire address space on 32-bit
| architectures.
CVE-2026-6244[5]:
| libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU
| instructions does not check whether the immediate value is zero. In
| particular uncommon use cases a crafted filter program can cause a
| division by zero.
CVE-2026-6554[6]:
| libpcap BPF interpreter treats the offset in the 'ja L' BPF
| instruction as a signed integer to implement looping via backward
| jumps, but it does not limit the number of loop iterations. In
| particular uncommon use cases a crafted filter program can cause the
| interpreter to loop infinitely.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-0799
https://www.cve.org/CVERecord?id=CVE-2026-0799
[1] https://security-tracker.debian.org/tracker/CVE-2026-18238
https://www.cve.org/CVERecord?id=CVE-2026-18238
[2] https://security-tracker.debian.org/tracker/CVE-2026-18313
https://www.cve.org/CVERecord?id=CVE-2026-18313
[3] https://security-tracker.debian.org/tracker/CVE-2026-31911
https://www.cve.org/CVERecord?id=CVE-2026-31911
[4] https://security-tracker.debian.org/tracker/CVE-2026-31912
https://www.cve.org/CVERecord?id=CVE-2026-31912
[5] https://security-tracker.debian.org/tracker/CVE-2026-6244
https://www.cve.org/CVERecord?id=CVE-2026-6244
[6] https://security-tracker.debian.org/tracker/CVE-2026-6554
https://www.cve.org/CVERecord?id=CVE-2026-6554
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libpcap
Source-Version: 1.10.7-1
Done: Sven Geuer <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libpcap, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sven Geuer <[email protected]> (supplier of updated libpcap package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 08 Sep 2026 15:56:57 +0200
Source: libpcap
Architecture: source
Version: 1.10.7-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <[email protected]>
Changed-By: Sven Geuer <[email protected]>
Closes: 1146825
Changes:
libpcap (1.10.7-1) unstable; urgency=medium
.
* Team upload.
.
[ Gianfranco Costamagna ]
* Edit changelog, drop extra newlines
.
[ Sven Geuer ]
* New upstream version 1.10.7 (Closes: #1146825)
- CVE-2026-0799: Access M[] safely in the BPF interpreter.
- CVE-2026-31912: Mind the program bounds in pcap_offline_filter().
- CVE-2026-31911: Fail opcodes safely in the BPF interpreter.
- CVE-2026-6244: Avoid division by zero via pcap_offline_filter().
- CVE-2026-6554: Limit "ja L" looping in pcap_offline_filter().
- CVE-2026-18313: Fix a memory leak in rpcapd.
- CVE-2026-18238: Fix RPCAP_MSG_PACKET validation.
Checksums-Sha1:
1744bda81b7d5ecc02f43f0af90bb7fe99469cc5 2339 libpcap_1.10.7-1.dsc
b95b0204a7ee243d4f972065328a89d492a42a44 686992 libpcap_1.10.7.orig.tar.xz
b787d6fd4cecf76ab8de5bc4c836e124bc22e4a9 667 libpcap_1.10.7.orig.tar.xz.asc
62eb0fe1c49833b58db3d41519631fb87070fe03 24148 libpcap_1.10.7-1.debian.tar.xz
9b5f63d30541903e72a4826bde5af34dfc1931be 6413 libpcap_1.10.7-1_amd64.buildinfo
Checksums-Sha256:
d6868b85a03361f45be66a95bb49e9c12a37b41e1e377834631e63e6ae05c0bb 2339
libpcap_1.10.7-1.dsc
68fa62cffb974f4275641ce14c2e2d75739251f30e00e6a0900903b247d76a03 686992
libpcap_1.10.7.orig.tar.xz
e2781d2daea2b4bfedc18fe7588a8e7a960c622eb786dfe5c23c756d08992c55 667
libpcap_1.10.7.orig.tar.xz.asc
22934aca1eebbed28e67b63d8c7198ab8978327ca1e2e0a25d8e490fb24c0362 24148
libpcap_1.10.7-1.debian.tar.xz
3685c14d2dce63eeb16bd40358d0354cc74149af766612d8399b8f379bb63d7e 6413
libpcap_1.10.7-1_amd64.buildinfo
Files:
53fb700896dac8d93d73e925c39deb6b 2339 devel optional libpcap_1.10.7-1.dsc
1418f40ebd08aec8b74d4c94aacbdab7 686992 devel optional
libpcap_1.10.7.orig.tar.xz
982987d28dd54241fa930cc06d96f253 667 devel optional
libpcap_1.10.7.orig.tar.xz.asc
d574117aaae830e56e8577fa67b28bc4 24148 devel optional
libpcap_1.10.7-1.debian.tar.xz
fa0a0d2b8ba20d0ec29d156adfdb067a 6413 devel optional
libpcap_1.10.7-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmqgIo4PHHNnZUBkZWJp
YW4ub3JnAAoJEK31Dtr4rdWFMNwP/RaBqXfiMaQqbvev0LU1daN5Qi04oZKAToho
6BNuTR66mzsSUgjpEb0ZKLv7xu6MtV8uDqK/NfURb5/yFaWYuFz4QvyO+nxsqSkK
6tUl1LBTDp1pIyDltgxYusG/rTaJhRooYwD9IfeTyfy8G+VYSDZP8WTigItbSjiS
5FMcX2c+7lX8/kz3RDy3fYDzFNkK9HiLEdWNXgFvJnMZLWCTxvXYMxm+d93boMZg
CuCBlfxS2NKDChQE3Y6yq5ri8VG25Bgl20xa3XePtUX3BJh4GR5LcDCa10wE8NKp
jwc9ix+zRs5DBGM2nGB27HWwoF6/t5PIgI7tiTppEjDUGBbhWWgOnE/PLW+8KYNd
1LfK9AjkJgCVFTizhoKp7eRTb8QTI3HxVVCkd7IfnvLj0GXAAuf31VZF664/dvQG
pB0ac6o3ewTtH4THTcBxk8//m90mxnu3+f8SuoaeG6WmtkocbMa82WzwCWSnRmvB
9p2/ldgl1mBbCskL+t72gO+Jd60ckUAhFte0xkSS17i1Hh/k/O7PAYLZYVHEcrTD
46KdWY0YAqoLwUqZ9dVytEL7FMTchxY+8xLX9kTpqRYY8ADh/z0p9xD9p9r/LVER
OgAvjBitmOLnKTdKse/eo8BA2QkNJeihObwECy/2/Qt2dKUbLjeCGWU0MNQDQJg4
lOqdLZcr
=S3tY
-----END PGP SIGNATURE-----
pgpurYzSdGOqL.pgp
Description: PGP signature
--- End Message ---
