CVE-2017-13029: The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:print_ccp_config_options().

Security readout for executives and security teams

This flaw affects tcpdump’s handling of PPP data. A vulnerable tcpdump version can read beyond the intended packet buffer while decoding PPP compression options. The business risk is highest where tcpdump processes untrusted network traffic or packet captures. The source bundle does not provide CVSS, CWE, or confirmed real-world exploitation. Exposure is likely on systems, appliances, containers, or forensic workflows using tcpdump versions before 4.9.2, including vendor-packaged builds not yet backported. Risk is more relevant where tcpdump parses untrusted captures or live PPP traffic. Treat this as a practical maintenance and exposure-reduction item, not an emergency based on the provided evidence. Prioritize internet-facing, shared, or automated packet-analysis environments first, especially where untrusted captures are processed. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor package that backports the fix.; Check Gentoo, Debian, Apple, and Red Hat advisories for platform-specific corrected packages.; Avoid processing untrusted packet captures with vulnerable tcpdump versions..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.