Ubuntu update for libpcap

1) Buffer overflow

EUVDB-ID: #VU21950

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15165

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the sf-pcapng.c in libpcap when processing the PHB header length before allocating memory. A remote attacker can pass specially crafted data to the application that uses the vulnerable library, trigger memory corruption and perform denial of service (DoS) attack.

Mitigation

Update the affected packages.

Ubuntu 19.04

libpcap0.8 - 1.8.1-6ubuntu1.19.04.1

Ubuntu 18.04 LTS

libpcap0.8 - 1.8.1-6ubuntu1.18.04.1

Ubuntu 16.04 LTS

libpcap0.8 - 1.7.4-2ubuntu0.1

Ubuntu 14.04 ESM

libpcap0.8 - 1.5.3-2ubuntu0.1

Vulnerable software versions

libpcap (Ubuntu package): 0.3-1 - transitional

External links

http://usn.ubuntu.com/4221-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.