PT-2017-3911 · Tcpdump+7 · Tcpdump+7

Bhargava Shastry + 1 · Published 2017-10-08 · Updated 2025-12-03 · CVE-2018-14461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.3

Description The issue is related to a buffer over-read in the LDP parser of the tcpdump utility, specifically in the ldp tlv print() function located in print-ldp.c. This can be exploited by a remote attacker to cause a denial of service or potentially gain unauthorized access to information, compromising its integrity and availability.

Recommendations For versions prior to 4.9.3, update to version 4.9.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ldp tlv print() function in print-ldp.c until a patch is applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-3120

ALT-PU-2020-3563

ALT-PU-2021-1433

BDU:2019-04650

BDU:2020-04918

CESA-2020_4760

CVE-2018-14461

DLA-1955-1

DSA-4547-1

MGASA-2019-0297

OPENSUSE-SU-2019:2344-1

OPENSUSE-SU-2019:2348-1

OPENSUSE-SU-2019_2344-1

OPENSUSE-SU-2019_2348-1

OPENSUSE-SU-2024:11425-1

RHSA-2020:4760

RHSA-2020_4760

RLSA-2020:4760

SUSE-SU-2019:14191-1

SUSE-SU-2019:2674-1

SUSE-SU-2019_14191-1

SUSE-SU-2020:3360-1

USN-4252-1

USN-4252-2

Affected Products

Alt Linux

Centos

Ibm Aix

Red Hat

Rocky Linux

Suse

Ubuntu

Tcpdump

References · 279

• https://github.com/the-tcpdump-group/tcpdump/commit/aa5c6b710dfd8020d2c908d6b3bd41f1da719b3b · Patch
• https://usn.ubuntu.com/4252-1 · Vendor Advisory
• https://usn.ubuntu.com/4252-2 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2020:4760 · Vendor Advisory
• https://debian.org/security/2019/dsa-4547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16227 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14461 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16229 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-15167 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4547-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10105 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2348-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1955-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:4760 · Vendor Advisory