CVE-2017-13014: The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep(), sev...

Security readout for executives and security teams

Tcpdump before 4.9.2 can read past a buffer while decoding White Board protocol data. For leaders, the concern is exposure in packet analysis workflows: a crafted packet or capture could affect analysts’ systems or automated monitoring that runs vulnerable tcpdump builds. Likely exposure is any host, appliance, forensic workstation, or monitoring workflow using tcpdump before 4.9.2 to decode traffic or packet captures. The source bundle does not enumerate specific downstream product CPEs. Prioritize remediation where tcpdump handles untrusted network traffic or packet captures. This is most urgent for SOC, incident response, and monitoring environments, but current source evidence does not show known active exploitation. Mitigation focus: Upgrade tcpdump to 4.9.2 or a later vendor-fixed package.; Apply relevant distro or platform advisories from Debian, Gentoo, Apple, or Red Hat.; Limit tcpdump processing of untrusted captures until patched..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.