CVE-2019-15164

rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.

• CWE-918

• http://seclists.org/fulldisclosure/2019/Dec/26
• https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGESProduct, Release Notes
• https://github.com/the-tcpdump-group/libpcap/commit/33834cb2a4d035b52aa2a26742f832a112e90a0aPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5K3DQ4TFSZBDB3XN4CZNJNQ3UIF3D3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GBIEKWLNIR62KZ5GA7EDXZS52HU6OE5F/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZTIPUWABYUE5KQOLCKAW65AUUSB7QO6/
• https://seclists.org/bugtraq/2019/Dec/23
• https://support.apple.com/kb/HT210785
• https://support.apple.com/kb/HT210788
• https://support.apple.com/kb/HT210789
• https://support.apple.com/kb/HT210790
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.tcpdump.org/public-cve-list.txtVendor Advisory
• http://seclists.org/fulldisclosure/2019/Dec/26
• https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.9/CHANGESProduct, Release Notes
• https://github.com/the-tcpdump-group/libpcap/commit/33834cb2a4d035b52aa2a26742f832a112e90a0aPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5K3DQ4TFSZBDB3XN4CZNJNQ3UIF3D3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GBIEKWLNIR62KZ5GA7EDXZS52HU6OE5F/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZTIPUWABYUE5KQOLCKAW65AUUSB7QO6/
• https://seclists.org/bugtraq/2019/Dec/23
• https://support.apple.com/kb/HT210785
• https://support.apple.com/kb/HT210788
• https://support.apple.com/kb/HT210789
• https://support.apple.com/kb/HT210790
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.tcpdump.org/public-cve-list.txtVendor Advisory

Published

Oct 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15151AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6…9.8
• CVE-2019-1516Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15160The SweetXml (aka sweet_xml) package through 0.6.6 for Erlan…
• CVE-2019-15161rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain l…5.3
• CVE-2019-15162rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platf…5.3
• CVE-2019-15163rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to …7.5
• CVE-2019-15165sf-pcapng.c in libpcap before 1.9.1 does not properly valida…5.3
• CVE-2019-15166lmp_print_data_link_subobjs() in print-lmp.c in tcpdump befo…7.5
• CVE-2019-15167The VRRP parser in tcpdump before 4.9.3 has a buffer over-re…9.1
• CVE-2019-1517Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-1518Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-1519Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…