CVE-2017-13015: The EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print().

Security readout for executives and security teams

Tcpdump versions before 4.9.2 can read past a memory boundary while parsing EAP network data. This matters because tcpdump is commonly used on security, network, and operations systems. The source bundle rates this critical, but it does not show confirmed active exploitation. Exposure is most likely on systems running tcpdump before 4.9.2 or vendor packages that had not backported the fix. Risk concentrates on hosts that capture or analyze untrusted network traffic or packet files. The bundle lacks precise CPEs, so inventory must use installed package versions and vendor advisory status. Prioritize remediation for security and network operations assets first. The vulnerability is old, but the stated severity is critical and tcpdump often runs in privileged operational contexts. Lack of KEV evidence lowers incident urgency, not patch priority for exposed systems. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Debian, Gentoo, Apple, or Red Hat guidance where applicable.; Prioritize systems capturing or analyzing untrusted network traffic..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.