Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.

An update of the libpcap package has been released.

Remote packet capture support is disabled by default in libpcap.  When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex().  One of the function arguments can be a filesystem path, which normally means a directory with input data files.  When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0505 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-8006:
    Remote packet capture support is disabled by default in libpcap.  When a user builds libpcap with remote     packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex().  One     of the function arguments can be a filesystem path, which normally means a directory with input data     files.  When the specified path cannot be used as a directory, the function receives NULL from opendir(),     but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer     derefence.

    CVE-2023-7256:
    In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns.  This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block.  A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-10 advisory.

  - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a     heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML     schema with certain identity constraints, or a crafted XML schema must be used. (CVE-2025-32415)

  - When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network     Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow     for local privilege escalation if users had not secured the directories in the non-default installation     location. (CVE-2025-24916)

  - In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a     non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM     privileges, potentially leading to local privilege escalation. (CVE-2025-24917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote     packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One     of the function arguments can be a filesystem path, which normally means a directory with input data     files. When the specified path cannot be used as a directory, the function receives NULL from opendir(),     but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer     derefence. (CVE-2024-8006)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of libpcap / nmap installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8006 advisory.

  - Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote     packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One     of the function arguments can be a filesystem path, which normally means a directory with input data     files. When the specified path cannot be used as a directory, the function receives NULL from opendir(),     but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer     derefence. (CVE-2024-8006)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libpcap / nmap installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8006 advisory.

  - Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote     packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One     of the function arguments can be a filesystem path, which normally means a directory with input data     files. When the specified path cannot be used as a directory, the function receives NULL from opendir(),     but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer     derefence. (CVE-2024-8006)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3355-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3217-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3210-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libpcap installed on the remote host is prior to 1.10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-244-01 advisory.

    New libpcap packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libpcap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
335075	Photon OS 5.0: Libpcap PHSA-2026-5.0-92-0954	Nessus	PhotonOS Local Security Checks	Local	medium
505104	Siemens SCALANCE and RUGGEDCOM NULL Pointer Dereference (CVE-2024-8006)	Tenable OT Security	Tenable.ot	Remote	medium
239383	TencentOS Server 4: libpcap (TSSA-2024:0505)	Nessus	Tencent Local Security Checks	Local	medium
237289	Nessus Network Monitor < 6.5.1 Multiple Vulnerabilities (TNS-2025-10)	Nessus	Misc.	Local	high
231956	Linux Distros Unpatched Vulnerability : CVE-2024-8006	Nessus	Misc.	Local	medium
215838	Azure Linux 3.0 Security Update: libpcap / nmap (CVE-2024-8006)	Nessus	Azure Linux Local Security Checks	Local	medium
210130	CBL Mariner 2.0 Security Update: libpcap / nmap (CVE-2024-8006)	Nessus	MarinerOS Local Security Checks	Local	medium
207574	SUSE SLED12 / SLES12 Security Update : libpcap (SUSE-SU-2024:3355-1)	Nessus	SuSE Local Security Checks	Local	medium
207224	SUSE SLED15: libpcap-devel / libpcap-devel-32bit / libpcap-devel-static / etc (SUSE-SU-2024:3217-1)	Nessus	SuSE Local Security Checks	Local	medium
207047	SUSE SLED15: libpcap-devel / libpcap-devel-32bit / libpcap-devel-static / etc (SUSE-SU-2024:3210-1)	Nessus	SuSE Local Security Checks	Local	medium
206412	Slackware Linux 15.0 / current libpcap Multiple Vulnerabilities (SSA:2024-244-01)	Nessus	Slackware Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-8006

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium