CVE-2017-13035: The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_id().

Security readout for executives and security teams

CVE-2017-13035 affects tcpdump before 4.9.2. A malicious or malformed ISO IS-IS packet or capture could make tcpdump read beyond a buffer while decoding traffic. For executives, the risk is highest where tcpdump processes untrusted network data on monitoring, operations, or forensic systems. Exposure is likely on systems running tcpdump before 4.9.2 or vendor packages derived from vulnerable tcpdump code. Prioritize network monitoring, incident response, packet capture analysis, and administrator workstations. The bundle's structured affected list is incomplete, so confirm exposure through package inventory and vendor advisories. Treat as high-priority remediation for systems that run tcpdump against untrusted traffic. The vulnerability is old, but critical severity and common operational use make stale packages a practical risk. Focus first on monitoring, troubleshooting, and incident response environments. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Debian, Gentoo, Apple, or Red Hat advisory updates.; Limit tcpdump use on untrusted packet captures until updated..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.