CVE-2016-7973: The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.

Security readout for executives and security teams

CVE-2016-7973 affects tcpdump versions before 4.9.0. A flaw in its AppleTalk packet parser can trigger a buffer overflow when tcpdump processes crafted traffic or capture files. This mainly matters on systems where tcpdump is installed and used for packet inspection, monitoring, or troubleshooting. Exposure is most likely on Linux or Unix systems with tcpdump installed, especially where users or services process untrusted packet captures or live network traffic containing AppleTalk data. Prioritize remediation where tcpdump is used operationally, by privileged users, or in automated analysis pipelines. This is not currently evidenced as actively exploited, but the affected tool often runs with elevated network visibility. Mitigation focus: Upgrade tcpdump to version 4.9.0 or later where available.; Apply relevant distribution security updates from Debian, Red Hat, Gentoo, or your vendor.; Restrict who can run tcpdump or submit packet captures for analysis..

Prepared

Jun 13, 2026, 10:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.