Read the docs
TI-2019-11325 Aliases CVE-2019-15165GHSA-4jh3-696v-qm6r

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

Priority LOW 35CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02834 86th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:tcpdump:libpcap:*:*:*:*:*:*:*:*before 1.9.1VulnerableThe Tcpdump Group
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*3.4VulnerableOracle
cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*4.0VulnerableOracle
cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:*4.1VulnerableOracle
cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:*4.2VulnerableOracle
cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*4.3VulnerableOracle
  • cpe:2.3:a:tcpdump:libpcap:*:*:*:*:*:*:*:* Versions before 1.9.1 Vulnerable ·The Tcpdump Group
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Oracle
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:apple:ipados:13.3:*:*:*:*:*:*:*13.3VulnerableApple
cpe:2.3:o:apple:iphone_os:13.3:*:*:*:*:*:*:*13.3VulnerableApple
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*10.13 to before 10.13.6VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*10.13.6 security_update_2019-007VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*10.14.6 security_update_2019-002VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.15.2:*:*:*:*:*:*:*10.15.2VulnerableApple
cpe:2.3:o:apple:tvos:13.3:*:*:*:*:*:*:*13.3VulnerableApple
cpe:2.3:o:apple:watchos:6.1.1:*:*:*:*:*:*:*6.1.1VulnerableApple
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
  • cpe:2.3:o:apple:ipados:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:iphone_os:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions 10.13 to before 10.13.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:* Versions 10.13.6 security_update_2019-007 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:* Versions 10.14.6 security_update_2019-002 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.15.2:*:*:*:*:*:*:* Versions 10.15.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:tvos:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·Apple
  • cpe:2.3:o:apple:watchos:6.1.1:*:*:*:*:*:*:* Versions 6.1.1 Vulnerable ·Apple
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject

Remediation

Red Hat 1 advisory

  • RHSA-2020:4547 Released 2020-11-04 · Red Hat rating Low
    libpcap security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) libpcap-devel-14:1.9.1-4.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) libpcap-14:1.9.1-4.el8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2020:4547
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:4547

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15165
  2. 2026-10-03 Alias added: GHSA-4jh3-696v-qm6r

References

Patch 2

Advisory 17

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences