In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-10 advisory.

  - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a     heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML     schema with certain identity constraints, or a crafted XML schema must be used. (CVE-2025-32415)

  - When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network     Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow     for local privilege escalation if users had not secured the directories in the non-default installation     location. (CVE-2025-24916)

  - In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a     non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM     privileges, potentially leading to local privilege escalation. (CVE-2025-24917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns. This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400. (CVE-2023-7256)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of libpcap / nmap installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-7256 advisory.

  - In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns. This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400. (CVE-2023-7256)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libpcap / nmap installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-7256 advisory.

  - In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns. This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400. (CVE-2023-7256)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3355-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3217-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3210-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libpcap installed on the remote host is prior to 1.10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-244-01 advisory.

    New libpcap packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libpcap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237289	Nessus Network Monitor < 6.5.1 Multiple Vulnerabilities (TNS-2025-10)	Nessus	Misc.	high
228045	Linux Distros Unpatched Vulnerability : CVE-2023-7256	Nessus	Misc.	medium
215725	Azure Linux 3.0 Security Update: libpcap / nmap (CVE-2023-7256)	Nessus	Azure Linux Local Security Checks	medium
211708	CBL Mariner 2.0 Security Update: libpcap / nmap (CVE-2023-7256)	Nessus	MarinerOS Local Security Checks	medium
207574	SUSE SLED12 / SLES12 Security Update : libpcap (SUSE-SU-2024:3355-1)	Nessus	SuSE Local Security Checks	medium
207224	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libpcap (SUSE-SU-2024:3217-1)	Nessus	SuSE Local Security Checks	medium
207047	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libpcap (SUSE-SU-2024:3210-1)	Nessus	SuSE Local Security Checks	medium
206412	Slackware Linux 15.0 / current libpcap Multiple Vulnerabilities (SSA:2024-244-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2023-7256

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium