CVE-2017-13013: The ARP parser in tcpdump before 4.9.2 has a buffer over-read in print-arp.c, several functions.

Security readout for executives and security teams

tcpdump versions before 4.9.2 can read past a buffer while parsing ARP data. Because tcpdump is often used on packet captures and network interfaces, exposure depends on whether vulnerable systems process untrusted traffic or capture files. The provided scoring is critical, but the bundle does not show active exploitation. Likely exposure is systems, appliances, forensic workstations, or operational tooling running tcpdump before 4.9.2. Risk is higher where tcpdump parses untrusted packet captures or observes attacker-controlled network traffic. Vendor-packaged tcpdump may be backported, so version validation should use distribution advisories, not only upstream version strings. Prioritize remediation where tcpdump is installed on security, network, or operations systems that inspect untrusted traffic. This is an older vulnerability with vendor fixes available, so the main business risk is legacy or embedded exposure that escaped patch management. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Debian, Gentoo, Apple, or Red Hat guidance where applicable.; Avoid parsing untrusted packet captures on vulnerable systems until fixed..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.