CVE-2019-15165: Apple iPadOS

Medium severity, CVSS 5.3. EPSS: 2.8% chance of exploitation in the next 30 days.

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

Affected products

• Apple iPadOS: version 13.3 only
• Apple iPhone OS: version 13.3 only
• Apple Mac OS X: from 10.13, before 10.13.6 (fixed in 10.13.6); version 10.13.6 only; version 10.14.6 only; version 10.15.2 only
• Apple tvOS: version 13.3 only
• Apple watchOS: version 6.1.1 only
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 29 only; version 30 only; version 31 only
• Opensuse Leap: version 15.0 only; version 15.1 only
• Oracle Communications Operations Monitor: version 3.4 only; version 4.0 only; version 4.1 only; version 4.2 only; version 4.3 only
• Tcpdump Libpcap: before 1.9.1 (fixed in 1.9.1)

Published 2019-10-03. Last modified 2026-06-17.