CVE-2023-7256
published 2024-08-31CVE-2023-7256: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly…
PriorityP416medium4.4CVSS 3.1
AVLACLPRHUINSUCNINAH
EPSS
0.23%
13.4th percentile
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libpcap | < libpcap 1.10.5-1 (forky) | libpcap 1.10.5-1 (forky) |
| msrc | azl3_libpcap_1.10.4-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_libpcap_1.10.5-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_nmap_7.95-2_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_libpcap_1.10.1-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_nmap_7.93-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| tcpdump | libpcap | < 1.10.5 | 1.10.5 |
| tcpdump | libpcap | >= 0 < 1.10.5-1 | 1.10.5-1 |
| tcpdump | libpcap | >= 0 < 1.10.5-1 | 1.10.5-1 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
osv9.8CRITICAL
cisa9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_msrc4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libpcap: Double Free in libcap
vendor_redhat·2024-08-31·CVSS 9.8
CVE-2023-7256 [CRITICAL] CWE-415 libpcap: Double Free in libcap
libpcap: Double Free in libcap
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
A vulnerability was found in libpcap. During the setup of a remote packet capture, the internal sock_initaddress() function calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function as to whether freeaddr
Microsoft
Double-free in libpcap before 1.10.5 with remote packet capture support.
vendor_msrc·2024-08-13·CVSS 4.4
CVE-2023-7256 [MEDIUM] CWE-415 Double-free in libpcap before 1.10.5 with remote packet capture support.
Double-free in libpcap before 1.10.5 with remote packet capture support.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Tcpdump: Tcpdump
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Ref
CISA
Nice Linear eMerge E3-Series OS Command Injection Vulnerability
cisa·2024-03-25·CVSS 9.8
CVE-2019-7256 [CRITICAL] CWE-78 Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Vulnerability: Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Affected: Nice Linear eMerge E3-Series
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
Required Action: Contact the vendor for guidance on remediating firmware, per their advisory.
Notes: https://linear-solutions.com/wp-content/uploads/E3-Bulletin-06-27-2023.pdf, https://www.cisa.gov/news-events/ics-advisories/icsa-24-065-01; https://nvd.nist.gov/vuln/detail/CVE-2019-7256
Remediation Due Date: 2024-04-15
Debian
CVE-2023-7256: libpcap - In affected libpcap versions during the setup of a remote packet capture the int...
vendor_debian·2023·CVSS 9.8
CVE-2023-7256 [CRITICAL] CVE-2023-7256: libpcap - In affected libpcap versions during the setup of a remote packet capture the int...
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.10.5-1)
sid: resolved (fixed in 1.10.5-1)
trixie: resolved (fixed in 1.10.5-1)
GHSA
GHSA-7m22-9mw3-j4pp: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
ghsa_unreviewed·2024-08-31·CVSS 9.8
CVE-2023-7256 [CRITICAL] CWE-415 GHSA-7m22-9mw3-j4pp: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
OSV
CVE-2023-7256: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
osv·2024-08-31·CVSS 9.8
CVE-2023-7256 [CRITICAL] CVE-2023-7256: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
No detection rules found.
No public exploits indexed.
2024-08-31
Published