CVE-2017-13033: The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().

Security readout for executives and security teams

CVE-2017-13033 is a tcpdump parsing flaw. Older tcpdump versions can read past a buffer while decoding VTP data, which may crash the tool or expose memory-adjacent behavior during packet analysis. The bundle does not provide CVSS, confirmed active exploitation, or detailed impact beyond buffer over-read. Exposure is likely limited to systems running tcpdump before 4.9.2 that parse VTP traffic or packet captures containing VTP data. This may include administrator workstations, servers, forensic systems, and network monitoring hosts with older vendor packages. Treat this as a maintenance and exposure-reduction item, not an emergency based on the supplied evidence. Prioritize systems that parse untrusted captures or run older operating system packages. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Debian, Gentoo, Apple, or Red Hat updates where applicable.; Avoid processing untrusted packet captures with vulnerable tcpdump versions..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.