CVE-2017-13003: The LMP parser in tcpdump before 4.9.2 has a buffer over-read in print-lmp.c:lmp_print().

Security readout for executives and security teams

CVE-2017-13003 is a tcpdump parsing flaw. A specially formed LMP packet or capture could make vulnerable tcpdump versions read beyond a buffer while decoding traffic. The sources identify affected tcpdump versions as before 4.9.2, but do not provide a CVSS score or confirmed business impact. Exposure is most likely on systems running tcpdump before 4.9.2 or vendor packages containing the vulnerable parser, especially packet-capture workstations, network monitoring hosts, appliances, and forensic workflows that parse untrusted traffic or capture files. Handle through normal vulnerability remediation unless tcpdump is used heavily in security monitoring or forensic intake. Prioritize hosts that inspect untrusted traffic or third-party capture files, because those workflows are closest to the vulnerable parser path. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-supported fixed package.; Apply relevant Debian, Gentoo, Apple, or Red Hat security updates where applicable.; Restrict parsing of untrusted packet captures until affected systems are updated..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.