CVE-2017-13030: The PIM parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c, several functions.

Security readout for executives and security teams

CVE-2017-13030 is a tcpdump flaw where malformed PIM network traffic can make older tcpdump versions read past buffer limits while parsing packets. This affects analysis systems using tcpdump before 4.9.2. The provided sources do not show active exploitation or a quantified severity score. Exposure is most likely on servers, workstations, appliances, or forensic workflows running tcpdump before 4.9.2, especially where tcpdump processes live traffic or untrusted packet captures containing PIM packets. Prioritize remediation as routine security maintenance unless tcpdump is used heavily on exposed monitoring systems or to inspect untrusted captures. There is no provided evidence of active exploitation, but affected versions are old and should be removed. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant OS vendor security updates for Gentoo, Debian, Apple, or Red Hat systems.; Restrict tcpdump use to trusted operators and controlled capture sources where possible..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.