CVE-2025-11961 (Low) detected in libpcaplibpcap-1.10.5, libpcaplibpcap-1.10.5

[mend-bolt-for-github]

CVE-2025-11961 - Low Severity Vulnerability

Vulnerable Libraries - libpcaplibpcap-1.10.5, libpcaplibpcap-1.10.5

libpcaplibpcap-1.10.5

the LIBpcap interface to various kernel packet capture mechanism

Library home page: https://github.com/salewski/libpcap.git

Vulnerable Source Files (2)

/contrib/libpcap/gencode.c
/contrib/libpcap/nametoaddr.c

libpcaplibpcap-1.10.5

the LIBpcap interface to various kernel packet capture mechanism

Library home page: https://github.com/salewski/libpcap.git

Vulnerable Source Files (2)

/contrib/libpcap/gencode.c
/contrib/libpcap/nametoaddr.c

Found in base branches: stable/4.0, master

Vulnerability Details

pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.

Publish Date: 2025-12-31

URL: CVE-2025-11961

CVSS 3 Score Details (1.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-12-31

Fix Resolution: https://github.com/the-tcpdump-group/libpcap.git - libpcap-1.10.6

---

Step up your Open Source Security Game with Mend here