CVE-2016-7984: The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print().

Security readout for executives and security teams

CVE-2016-7984 is a buffer overflow in tcpdump’s TFTP packet parser before version 4.9.0. It matters where tcpdump is used to inspect live traffic or packet captures, especially untrusted captures. The source bundle does not provide CVSS, confirmed impact, or evidence of active exploitation. Exposure is most likely on systems running tcpdump before 4.9.0, including analyst workstations, servers, monitoring hosts, and appliances that inspect packets. Distribution packages may be patched through backports, so version validation should use vendor advisory status, not only upstream version numbers. Treat this as a targeted maintenance item, not an emergency based on current evidence. Prioritize security monitoring systems and analyst workstations because they are most likely to process untrusted packet data. Confirm vendor patch status during normal vulnerability management cycles. Mitigation focus: Upgrade tcpdump to 4.9.0 or a vendor-fixed package.; Apply Debian DSA-3775, Red Hat RHSA-2017:1871, or Gentoo GLSA-201702-30 where applicable.; Avoid opening untrusted packet captures with vulnerable tcpdump versions..

Prepared

Jun 13, 2026, 10:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.