Libpcap
CVE-2019-15163
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails.
AnalysisAI
rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified as NULL Pointer Dereference (CWE-476), which allows attackers to crash the application by dereferencing a null pointer. rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. Affected products include: Tcpdump Libpcap. Version information: before 1.9.1.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Check pointers before dereferencing. Use static analysis tools to detect null pointer paths.
Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low pr
Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process
Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filt
Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any applicati
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated med
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium seve
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium se
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected c
Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is
Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash th
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today