CVE-2017-11108

HIGH7.5EPSS 1.1%

tcpdump - security update

Published: 7/8/2017Modified: 4/28/2026

Description

tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol.

Affected packages (4)

Alpine/tcpdumpfrom 0, < 4.9.1-r0
Debian/tcpdumpfrom 0, < 4.9.1-1
Debian/tcpdumpfrom 0, < 4.9.0-1~deb7u2
Debian/tcpdumpfrom 0, < 4.9.2-1~deb8u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2017-11108
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-11108