<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
	<DocumentTitle xml:lang="en">An update for libpcap is now available for openEuler-24.03-LTS-SP2</DocumentTitle>
	<DocumentType>Security Advisory</DocumentType>
	<DocumentPublisher Type="Vendor">
		<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
		<IssuingAuthority>openEuler security committee</IssuingAuthority>
	</DocumentPublisher>
	<DocumentTracking>
		<Identification>
			<ID>openEuler-SA-2026-1111</ID>
		</Identification>
		<Status>Final</Status>
		<Version>1.0</Version>
		<RevisionHistory>
			<Revision>
				<Number>1.0</Number>
				<Date>2026-01-16</Date>
				<Description>Initial</Description>
			</Revision>
		</RevisionHistory>
		<InitialReleaseDate>2026-01-16</InitialReleaseDate>
		<CurrentReleaseDate>2026-01-16</CurrentReleaseDate>
		<Generator>
			<Engine>openEuler SA Tool V1.0</Engine>
			<Date>2026-01-16</Date>
		</Generator>
	</DocumentTracking>
	<DocumentNotes>
		<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">libpcap security update</Note>
		<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for libpcap is now available for openEuler-24.03-LTS-SP2</Note>
		<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">This is the official web site of tcpdump, a powerful command-line 
packet analyzer; and libpcap, a portable C/C++ library for 
network traffic capture.

Security Fix(es):

pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer.  The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented.  If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.(CVE-2025-11961)</Note>
		<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for libpcap is now available for openEuler-24.03-LTS-SP2.

openEuler Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
		<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">Low</Note>
		<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">libpcap</Note>
	</DocumentNotes>
	<DocumentReferences>
		<Reference Type="Self">
			<URL>https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1111</URL>
		</Reference>
		<Reference Type="openEuler CVE">
			<URL>https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-11961</URL>
		</Reference>
		<Reference Type="Other">
			<URL>https://nvd.nist.gov/vuln/detail/CVE-2025-11961</URL>
		</Reference>
	</DocumentReferences>
	<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
		<Branch Type="Product Name" Name="openEuler">
			<FullProductName ProductID="openEuler-24.03-LTS-SP2" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">openEuler-24.03-LTS-SP2</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="aarch64">
			<FullProductName ProductID="libpcap-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-1.10.4-5.oe2403sp2.aarch64.rpm</FullProductName>
			<FullProductName ProductID="libpcap-debuginfo-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-debuginfo-1.10.4-5.oe2403sp2.aarch64.rpm</FullProductName>
			<FullProductName ProductID="libpcap-debugsource-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-debugsource-1.10.4-5.oe2403sp2.aarch64.rpm</FullProductName>
			<FullProductName ProductID="libpcap-devel-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-devel-1.10.4-5.oe2403sp2.aarch64.rpm</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="src">
			<FullProductName ProductID="libpcap-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-1.10.4-5.oe2403sp2.src.rpm</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="x86_64">
			<FullProductName ProductID="libpcap-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-1.10.4-5.oe2403sp2.x86_64.rpm</FullProductName>
			<FullProductName ProductID="libpcap-debuginfo-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-debuginfo-1.10.4-5.oe2403sp2.x86_64.rpm</FullProductName>
			<FullProductName ProductID="libpcap-debugsource-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-debugsource-1.10.4-5.oe2403sp2.x86_64.rpm</FullProductName>
			<FullProductName ProductID="libpcap-devel-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-devel-1.10.4-5.oe2403sp2.x86_64.rpm</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="noarch">
			<FullProductName ProductID="libpcap-help-1.10.4-5" CPE="cpe:/a:openEuler:openEuler:24.03-LTS-SP2">libpcap-help-1.10.4-5.oe2403sp2.noarch.rpm</FullProductName>
		</Branch>
	</ProductTree>
	<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
		<Notes>
			<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer.  The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented.  If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.</Note>
		</Notes>
		<ReleaseDate>2026-01-16</ReleaseDate>
		<CVE>CVE-2025-11961</CVE>
		<ProductStatuses>
			<Status Type="Fixed">
				<ProductID>openEuler-24.03-LTS-SP2</ProductID>
			</Status>
		</ProductStatuses>
		<Threats>
			<Threat Type="Impact">
				<Description>Low</Description>
			</Threat>
		</Threats>
		<CVSSScoreSets>
			<ScoreSet>
				<BaseScore>1.9</BaseScore>
				<Vector>AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N</Vector>
			</ScoreSet>
		</CVSSScoreSets>
		<Remediations>
			<Remediation Type="Vendor Fix">
				<Description>libpcap security update</Description>
				<DATE>2026-01-16</DATE>
				<URL>https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1111</URL>
			</Remediation>
		</Remediations>
	</Vulnerability>
</cvrfdoc>