[ Reason ]
Upstream released bugfix releases 1.10.6 and 1.10.7 containing fixes
for a number of CVEs:
- CVE-2025-11961: Fix OOBR and OOBW in pcap_ether_aton().
- CVE-2026-0799: Access M[] safely in the BPF interpreter.
- CVE-2026-31912: Mind the program bounds in pcap_offline_filter().
- CVE-2026-31911: Fail opcodes safely in the BPF interpreter.
- CVE-2026-6244: Avoid division by zero via pcap_offline_filter().
- CVE-2026-6554: Limit "ja L" looping in pcap_offline_filter().
- CVE-2026-18313: Fix a memory leak in rpcapd.
- CVE-2026-18238: Fix RPCAP_MSG_PACKET validation.
The related bugs #1124381, #1146825 have been fixed already in Debian
for sid and testing. With this upload I aim at fixing them also for
trixie.
[ Impact ]
Without this update the listed CVEs would stay unfixed in trixie.
[ Tests ]
I successfully build and ran autopkgtests on debusine, see
https://debusine.debian.net/debian/developers/work-request/1432737.
The failure of some tests are not related to libpcap:
autopkgtest amd64 for dpdk/24.11.4-0+deb13u1:
Failed creating instance record: Instance type "virtual-machine" is not
supported on this server
https://debusine.debian.net/debian/developers/artifact/5002089/
autopkgtests for suricata/1:7.0.10-1+deb13u4:
Fails independently from libpcap
https://ci.debian.net/packages/s/suricata/
autopkgtest amd64 for xdp-tools/1.5.4-1:
Failed creating instance record: Instance type "virtual-machine" is not
supported on this server
https://debusine.debian.net/debian/developers/artifact/5002195/
[ Risks ]
My first approach was to backport the CVE fixes to libpcap 1.10.5,
however that would have required me to as well backport code not
related to the CVEs. Uploading upstreams 1.10.7 seems less risky to me
given that no new bugs where raised against libpcap since the 1.10.7-1
release. For a detailled list of upstream changes to 1.10.6 and 1.10.7
see https://sources.debian.org/src/libpcap/1.10.7-1/CHANGES.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable