Divide By Zero Affecting tcpreplay package, versions <4.5.2-1


Severity

Recommended
0.0
low
0
10

Based on Debian security rating.

Threat Intelligence

EPSS
0.01% (2nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-TCPREPLAY-12240268
  • published30 Aug 2025
  • disclosed29 Aug 2025

Introduced: 29 Aug 2025

NewCVE-2025-9649  (opens in a new tab)
CWE-369  (opens in a new tab)
CWE-404  (opens in a new tab)

How to fix?

Upgrade Debian:unstable tcpreplay to version 4.5.2-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tcpreplay package and not the tcpreplay package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3."

CVSS Base Scores

version 3.1