sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.01484.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Apple Subscribe
Ipados Subscribe
Iphone Os Subscribe
Mac Os X Subscribe
Tvos Subscribe
Watchos Subscribe
Canonical Subscribe
Ubuntu Linux Subscribe
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe
Opensuse Subscribe
Leap Subscribe
Oracle Subscribe
Communications Operations Monitor Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Tcpdump Subscribe
Libpcap Subscribe

Configuration 1 [-]

cpe:2.3:a:tcpdump:libpcap:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*

Configuration 5 [-]

OR cpe:2.3:o:apple:ipados:13.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:13.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:13.3:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:6.1.1:*:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Configuration 7 [-]

OR cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
libpcap-14:1.9.1-4.el8 cpe:/o:redhat:enterprise_linux:8 RHSA-2020:4547 2020-11-04T00:00:00Z

No data.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-1967-1 libpcap security update
Debian DLA Debian DLA DLA-2850-1 libpcap security update
EUVD EUVD EUVD-2019-6221 sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.
Ubuntu USN Ubuntu USN USN-4221-1 libpcap vulnerability
Ubuntu USN Ubuntu USN USN-4221-2 libpcap vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00051.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00052.html cve-icon cve-icon
http://seclists.org/fulldisclosure/2019/Dec/26 cve-icon cve-icon
https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGES cve-icon cve-icon
https://github.com/the-tcpdump-group/libpcap/commit/87d6bef033062f969e70fa40c43dfd945d5a20ab cve-icon cve-icon
https://github.com/the-tcpdump-group/libpcap/commit/a5a36d9e82dde7265e38fe1f87b7f11c461c29f6 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/10/msg00031.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2021/12/msg00014.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5K3DQ4TFSZBDB3XN4CZNJNQ3UIF3D3/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GBIEKWLNIR62KZ5GA7EDXZS52HU6OE5F/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZTIPUWABYUE5KQOLCKAW65AUUSB7QO6/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2019-15165 cve-icon
https://seclists.org/bugtraq/2019/Dec/23 cve-icon cve-icon
https://support.apple.com/kb/HT210785 cve-icon cve-icon
https://support.apple.com/kb/HT210788 cve-icon cve-icon
https://support.apple.com/kb/HT210789 cve-icon cve-icon
https://support.apple.com/kb/HT210790 cve-icon cve-icon
https://usn.ubuntu.com/4221-1/ cve-icon cve-icon
https://usn.ubuntu.com/4221-2/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2019-15165 cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.tcpdump.org/public-cve-list.txt cve-icon cve-icon
History

Wed, 03 Dec 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-12-03T19:06:21.272Z

Reserved: 2019-08-19T00:00:00.000Z

Link: CVE-2019-15165

cve-icon Vulnrichment

Updated: 2024-08-05T00:42:03.742Z

cve-icon NVD

Status : Modified

Published: 2019-10-03T19:15:09.473

Modified: 2025-12-03T19:15:48.053

Link: CVE-2019-15165

cve-icon Redhat

Severity : Low

Publid Date: 2019-09-20T00:00:00Z

Links: CVE-2019-15165 - Bugzilla

cve-icon OpenCVE Enrichment

No data.