Out-of-bounds Read Affecting tcpdump package, versions <4.9.3~git20190901-1


Severity

Recommended
low

Based on Debian security rating.

Threat Intelligence

EPSS
0.17% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-TCPDUMP-531206
  • published13 Nov 2017
  • disclosed13 Nov 2017

Introduced: 13 Nov 2017

CVE-2017-16808  (opens in a new tab)
CWE-125  (opens in a new tab)

How to fix?

Upgrade Debian:11 tcpdump to version 4.9.3~git20190901-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tcpdump package and not the tcpdump package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c.

References