CVE-2017-13037: The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts().

Security readout for executives and security teams

CVE-2017-13037 is a tcpdump parsing flaw present before version 4.9.2. When tcpdump parses certain IP timestamp data, it can read past the intended buffer. This matters most on systems where tcpdump handles untrusted live traffic or packet captures. Exposure is likely on systems running tcpdump versions earlier than 4.9.2, especially monitoring, troubleshooting, forensics, or packet-inspection hosts that process untrusted network traffic or capture files. Prioritize remediation on network monitoring, incident response, and administrative systems where tcpdump processes untrusted traffic. The CVSS score is critical, but active exploitation is not established in the provided evidence. Mitigation focus: Upgrade tcpdump to version 4.9.2 or a vendor-patched package.; Apply relevant vendor advisories for Debian, Gentoo, Apple, or Red Hat environments.; Restrict tcpdump use to trusted packet sources until patched..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.