In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns.  This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block.  A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The version of libpcap installed on the remote host is prior to 1.10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-244-01 advisory.

    New libpcap packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the libpcap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3217-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3355-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libpcap / nmap installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-7256 advisory.

  - In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns. This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400. (CVE-2023-7256)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libpcap / nmap installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-7256 advisory.

  - In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns. This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400. (CVE-2023-7256)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns. This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400. (CVE-2023-7256)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0505 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-8006:
    Remote packet capture support is disabled by default in libpcap.  When a user builds libpcap with remote     packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex().  One     of the function arguments can be a filesystem path, which normally means a directory with input data     files.  When the specified path cannot be used as a directory, the function receives NULL from opendir(),     but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer     derefence.

    CVE-2023-7256:
    In affected libpcap versions during the setup of a remote packet capture the internal function     sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the     caller function whether freeaddrinfo() still remains to be called after the function returns.  This makes     it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same     allocated memory block.  A similar problem was reported in Apple libpcap, to which Apple assigned     CVE-2023-40400.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-10 advisory.

  - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a     heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML     schema with certain identity constraints, or a crafted XML schema must be used. (CVE-2025-32415)

  - When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network     Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow     for local privilege escalation if users had not secured the directories in the non-default installation     location. (CVE-2025-24916)

  - In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a     non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM     privileges, potentially leading to local privilege escalation. (CVE-2025-24917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3210-1 advisory.

    - CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034)
    - CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
505128	Siemens SCALANCE and RUGGEDCOM Double Free (CVE-2023-7256)	Tenable OT Security	Tenable.ot	2/10/2026	3/5/2026	medium
206412	Slackware Linux 15.0 / current libpcap Multiple Vulnerabilities (SSA:2024-244-01)	Nessus	Slackware Local Security Checks	8/31/2024	1/21/2026	medium
207224	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libpcap (SUSE-SU-2024:3217-1)	Nessus	SuSE Local Security Checks	9/13/2024	1/21/2026	medium
207574	SUSE SLED12 / SLES12 Security Update : libpcap (SUSE-SU-2024:3355-1)	Nessus	SuSE Local Security Checks	9/22/2024	1/21/2026	medium
211708	CBL Mariner 2.0 Security Update: libpcap / nmap (CVE-2023-7256)	Nessus	MarinerOS Local Security Checks	11/21/2024	1/21/2026	medium
215725	Azure Linux 3.0 Security Update: libpcap / nmap (CVE-2023-7256)	Nessus	Azure Linux Local Security Checks	2/10/2025	1/21/2026	medium
228045	Linux Distros Unpatched Vulnerability : CVE-2023-7256	Nessus	Misc.	3/5/2025	8/30/2025	medium
239383	TencentOS Server 4: libpcap (TSSA-2024:0505)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	medium
237289	Nessus Network Monitor < 6.5.1 Multiple Vulnerabilities (TNS-2025-10)	Nessus	Misc.	5/27/2025	5/30/2025	high
207047	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libpcap (SUSE-SU-2024:3210-1)	Nessus	SuSE Local Security Checks	9/12/2024	1/21/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

high

medium