CVE-2017-13012: The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().

Security readout for executives and security teams

CVE-2017-13012 is a tcpdump flaw where malformed ICMP data can make older tcpdump versions read beyond the intended buffer while parsing traffic. This affects analysis tooling rather than a typical internet-facing service, but it matters where staff inspect untrusted packet captures or live traffic. Exposure is most likely on endpoints, servers, appliances, or analysis workstations running tcpdump before 4.9.2, especially where ICMP packets or untrusted packet captures are inspected. Treat this as routine but real patching work for security and operations tooling. Prioritize environments that process external packet captures or run packet inspection during incident response. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-patched package.; Apply relevant Debian, Gentoo, Apple, or Red Hat updates where applicable.; Limit analysis of untrusted packet captures until tcpdump is updated..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.