CVE-2017-12991: The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print().

Security readout for executives and security teams

CVE-2017-12991 is a tcpdump parsing flaw: versions before 4.9.2 can read past a buffer when decoding BGP attributes. Business impact is mainly availability and analysis-tool reliability: a crafted packet or capture could crash or destabilize tcpdump during network inspection. The bundle does not show active exploitation or remote system compromise. Exposure is most likely on systems running tcpdump before 4.9.2, especially hosts or analyst workstations that inspect live BGP traffic or open untrusted packet captures. Appliances or workflows that embed tcpdump may also be relevant, but the bundle does not identify specific embedded products. Treat this as a targeted maintenance item, not an emergency, unless tcpdump is widely used to inspect untrusted BGP traffic or external capture files. Prioritize analyst systems, network monitoring hosts, and any packaged appliances that include tcpdump. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-patched later package.; Apply relevant OS vendor updates from Gentoo, Debian, Apple, or Red Hat guidance.; Avoid opening untrusted packet captures on vulnerable analysis systems..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.