CVE-2017-12900: Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in util-print.c:tok2strbuf().

Security readout for executives and security teams

CVE-2017-12900 is a tcpdump parsing flaw. Older tcpdump versions before 4.9.2 could read past an internal buffer while decoding certain protocol data. Business risk is mainly to systems or analysts that process untrusted traffic captures. The provided sources do not show active exploitation or remote code execution. Exposure is most likely where tcpdump is installed and used to inspect live network traffic or packet capture files from untrusted sources. Linux distributions and Apple platforms referenced advisories, but the bundle does not enumerate exact package versions beyond tcpdump before 4.9.2. Treat this as a routine but necessary hygiene fix for network-analysis environments. Prioritize systems that process untrusted captures or monitor hostile networks. The urgency is lower than known-exploited vulnerabilities, but patched packages have long been available. Mitigation focus: Upgrade tcpdump to version 4.9.2 or a vendor-fixed package.; Apply relevant OS vendor security updates from Gentoo, Debian, Apple, or Red Hat.; Avoid processing untrusted packet captures with vulnerable tcpdump builds..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.