CVE-2017-5342

In tcpdump before 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print().
Severity
CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Atk. Vector
NETWORK
Atk. Complexity
LOW
Priv. Required
NONE
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
VendorProductVersion
tcpdumptcpdump
𝑥
≤ 4.8.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tcpdump
bullseye
4.99.0-2+deb11u1
fixed
bookworm
4.99.3-1
fixed
sid
4.99.5-1
fixed
trixie
4.99.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tcpdump
yakkety
Fixed 4.9.0-1ubuntu1~ubuntu16.10.1
released
xenial
Fixed 4.9.0-1ubuntu1~ubuntu16.04.1
released
trusty
Fixed 4.9.0-1ubuntu1~ubuntu14.04.1
released
precise
Fixed 4.9.0-1ubuntu1~ubuntu12.04.1
released
Common Weakness Enumeration
References
http://www.debian.org/security/2017/dsa-3775
http://www.securityfocus.com/bid/95852
http://www.securitytracker.com/id/1037755
https://access.redhat.com/errata/RHSA-2017:1871
https://security.gentoo.org/glsa/201702-30
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1494526.html
http://www.debian.org/security/2017/dsa-3775
http://www.securityfocus.com/bid/95852
http://www.securitytracker.com/id/1037755
https://access.redhat.com/errata/RHSA-2017:1871
https://security.gentoo.org/glsa/201702-30
https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1494526.html