CVE-2023-7256
published 2024-08-31CVE-2023-7256: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly…
PriorityP416medium4.4CVSS 3.1
AVLACLPRHUINSUCNINAH
EPSS
0.24%
14.7th percentile
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libpcap | < libpcap 1.10.5-1 (forky) | libpcap 1.10.5-1 (forky) |
| msrc | azl3_libpcap_1.10.4-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_libpcap_1.10.5-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_nmap_7.95-2_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_libpcap_1.10.1-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_nmap_7.93-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| tcpdump | libpcap | < 1.10.5 | 1.10.5 |
| tcpdump | libpcap | >= 0 < 1.10.5-1 | 1.10.5-1 |
| tcpdump | libpcap | >= 0 < 1.10.5-1 | 1.10.5-1 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
osv9.8CRITICAL
cisa9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_msrc4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libpcap: Double Free in libcap
vendor_redhat·2024-08-31·CVSS 9.8
CVE-2023-7256 [CRITICAL] CWE-415 libpcap: Double Free in libcap
libpcap: Double Free in libcap
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
A vulnerability was found in libpcap. During the setup of a remote packet capture, the internal sock_initaddress() function calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function as to whether freeaddr
Microsoft
Double-free in libpcap before 1.10.5 with remote packet capture support.
vendor_msrc·2024-08-13·CVSS 4.4
CVE-2023-7256 [MEDIUM] CWE-415 Double-free in libpcap before 1.10.5 with remote packet capture support.
Double-free in libpcap before 1.10.5 with remote packet capture support.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Tcpdump: Tcpdump
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Ref
CISA
Nice Linear eMerge E3-Series OS Command Injection Vulnerability
cisa·2024-03-25·CVSS 9.8
CVE-2019-7256 [CRITICAL] CWE-78 Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Vulnerability: Nice Linear eMerge E3-Series OS Command Injection Vulnerability
Affected: Nice Linear eMerge E3-Series
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
Required Action: Contact the vendor for guidance on remediating firmware, per their advisory.
Notes: https://linear-solutions.com/wp-content/uploads/E3-Bulletin-06-27-2023.pdf, https://www.cisa.gov/news-events/ics-advisories/icsa-24-065-01; https://nvd.nist.gov/vuln/detail/CVE-2019-7256
Remediation Due Date: 2024-04-15
Debian
CVE-2023-7256: libpcap - In affected libpcap versions during the setup of a remote packet capture the int...
vendor_debian·2023·CVSS 9.8
CVE-2023-7256 [CRITICAL] CVE-2023-7256: libpcap - In affected libpcap versions during the setup of a remote packet capture the int...
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.10.5-1)
sid: resolved (fixed in 1.10.5-1)
trixie: resolved (fixed in 1.10.5-1)
GHSA
GHSA-7m22-9mw3-j4pp: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
ghsa_unreviewed·2024-08-31·CVSS 9.8
CVE-2023-7256 [CRITICAL] CWE-415 GHSA-7m22-9mw3-j4pp: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
OSV
CVE-2023-7256: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
osv·2024-08-31·CVSS 9.8
CVE-2023-7256 [CRITICAL] CVE-2023-7256: In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly fre
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-7256 libpcap: Double Free in libcap
bugzilla·2024-08-31·CVSS 9.8
CVE-2023-7256 [CRITICAL] CVE-2023-7256 libpcap: Double Free in libcap
CVE-2023-7256 libpcap: Double Free in libcap
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.
Discussion:
libcap 2.48, 2.69, or 2.170 doesn't have "sock_initaddress".
Also the OSIDB import refers to libpcap ("p" in the middle). A different library
---
You created the issue for libcap, but I think you meant libpcap: https:/
Wiz
CVE-2025-11961 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-11961 [HIGH] CVE-2025-11961 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-11961 :
Nmap vulnerability analysis and mitigation
pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.
Source : NVD
## 1.9
Score
Published December 31, 2025
Severity LOW
CNA Score 1.9
Affected Technologies
Nmap
CBL Mariner
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Pe
2024-08-31
Published