libpcap - Debian Package Tracker

general

source: libpcap (main)
version: 1.10.6-2
maintainer: Debian Security Tools (DMD)
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.10.0-2
oldstable: 1.10.3-1
stable: 1.10.5-2
testing: 1.10.6-2
unstable: 1.10.6-2

versioned links

1.10.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.10.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.10.5-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.10.6-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libpcap-dev
libpcap0.8-dev (1 bugs: 0, 1, 0, 0)
libpcap0.8t64

action needed

7 security issues in sid high

There are 7 open security issues in sid.

7 important issues:

CVE-2026-0799: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
CVE-2026-6244: libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
CVE-2026-6554: libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
CVE-2026-18238: The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
CVE-2026-18313: rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.
CVE-2026-31911: libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
CVE-2026-31912: libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.

Created: 2026-09-05 Last update: 2026-09-06 22:17

7 security issues in forky high

There are 7 open security issues in forky.

7 important issues:

CVE-2026-0799: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
CVE-2026-6244: libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
CVE-2026-6554: libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
CVE-2026-18238: The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
CVE-2026-18313: rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.
CVE-2026-31911: libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
CVE-2026-31912: libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.

Created: 2026-09-05 Last update: 2026-09-06 22:17

8 security issues in bookworm high

There are 8 open security issues in bookworm.

7 important issues:

CVE-2026-0799: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
CVE-2026-6244: libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
CVE-2026-6554: libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
CVE-2026-18238: The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
CVE-2026-18313: rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.
CVE-2026-31911: libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
CVE-2026-31912: libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.

1 issue postponed or untriaged:

CVE-2025-11961: (needs triaging) pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.

Created: 2026-09-05 Last update: 2026-09-06 22:17

lintian reports 1 error high

Lintian reports 1 error about this package. You should make the package lintian clean getting rid of them.

Created: 2025-02-09 Last update: 2026-07-15 04:47

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-09-07 12:00

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 9d416fb25a6282f65cd38cc16e70ed87243d818c
Author: Gianfranco Costamagna <locutusofborg@debian.org>
Date:   Wed Jul 15 13:17:23 2026 +0000

    Edit changelog, drop extra newlines

https://salsa.debian.org/api/v4/projects/debian%2Flibpcap API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-15 Last update: 2026-09-04 00:03

8 low-priority security issues in trixie low

There are 8 open security issues in trixie.

8 issues left for the package maintainer to handle:

CVE-2026-0799: (needs triaging) In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
CVE-2026-6244: (needs triaging) libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
CVE-2026-6554: (needs triaging) libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
CVE-2025-11961: (needs triaging) pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.
CVE-2026-18238: (needs triaging) The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
CVE-2026-18313: (needs triaging) rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.
CVE-2026-31911: (needs triaging) libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
CVE-2026-31912: (needs triaging) libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-12-31 Last update: 2026-09-06 22:17

debian/patches: 1 patch to forward upstream low

Among the 5 debian patches available in version 1.10.6-2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-07-15 Last update: 2026-07-15 10:01

news

[rss feed]

[2026-07-20] libpcap 1.10.6-2 MIGRATED to testing (Debian testing watch)
[2026-07-14] Accepted libpcap 1.10.6-2 (source) into unstable (Sven Geuer)
[2026-02-21] libpcap 1.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-02-15] Accepted libpcap 1.10.6-1 (source) into unstable (Peter Wienemann)
[2025-02-14] libpcap 1.10.5-2 MIGRATED to testing (Debian testing watch)
[2025-02-09] Accepted libpcap 1.10.5-2 (source) into unstable (Romain Francoise)
[2024-09-12] libpcap 1.10.5-1 MIGRATED to testing (Debian testing watch)
[2024-09-01] Accepted libpcap 1.10.5-1 (source) into unstable (Romain Francoise)
[2024-05-09] libpcap 1.10.4-5 MIGRATED to testing (Debian testing watch)
[2024-05-04] Accepted libpcap 1.10.4-5 (source) into unstable (Romain Francoise)
[2024-05-02] libpcap 1.10.4-4.1 MIGRATED to testing (Debian testing watch)
[2024-02-28] Accepted libpcap 1.10.4-4.1 (source) into unstable (Benjamin Drung)
[2024-02-02] Accepted libpcap 1.10.4-4.1~exp1 (source) into experimental (Steve Langasek)
[2023-08-21] libpcap 1.10.4-4 MIGRATED to testing (Debian testing watch)
[2023-08-14] Accepted libpcap 1.10.4-4 (source) into unstable (Romain Francoise)
[2023-07-27] libpcap 1.10.4-3 MIGRATED to testing (Debian testing watch)
[2023-07-22] Accepted libpcap 1.10.4-3 (source) into unstable (Romain Francoise)
[2023-06-23] libpcap 1.10.4-2 MIGRATED to testing (Debian testing watch)
[2023-06-17] Accepted libpcap 1.10.4-2 (source) into unstable (Romain Francoise)
[2023-04-10] Accepted libpcap 1.10.4-1 (source) into experimental (Romain Francoise)
[2023-01-21] Accepted libpcap 1.10.3-1~bpo11+1 (source) into bullseye-backports (Romain Francoise)
[2023-01-20] libpcap 1.10.3-1 MIGRATED to testing (Debian testing watch)
[2023-01-14] Accepted libpcap 1.10.3-1 (source) into unstable (Romain Francoise)
[2023-01-12] Accepted libpcap 1.10.2-1~bpo11+1 (source) into bullseye-backports (Romain Francoise)
[2023-01-10] libpcap 1.10.2-1 MIGRATED to testing (Debian testing watch)
[2023-01-03] Accepted libpcap 1.10.2-1 (source) into unstable (Romain Francoise)
[2022-03-05] Accepted libpcap 1.8.1-6+deb10u1 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2021-12-26] Accepted libpcap 1.8.1-3+deb9u1 (source) into oldoldstable (Adrian Bunk)
[2021-11-13] Accepted libpcap 1.10.1-4~bpo11+1 (amd64 source) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Romain Francoise)
[2021-09-10] libpcap 1.10.1-4 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 12
RC: 0
I&N: 5
M&W: 7
F&P: 0
patch: 1

links

homepage
lintian (1, 0)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.10.6-2ubuntu1
2 bugs
patches for 1.10.6-2ubuntu1