CVE-2017-13038: The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().

Security readout for executives and security teams

Tcpdump before 4.9.2 can read beyond packet memory while parsing PPP/MLPPP data. For the business, the concern is disruption or sensitive memory exposure when packet captures or live traffic are inspected, especially in automated monitoring or incident-response pipelines. Exposure is most likely on systems running tcpdump before 4.9.2, or vendor packages containing that vulnerable code, where PPP or MLPPP traffic or capture files are parsed. Prioritize remediation where tcpdump handles untrusted traffic or captures. Although active exploitation is not evidenced in the bundle, the CVSS 9.8 score and simple attack preconditions justify prompt patching. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Gentoo, Debian, Apple, or Red Hat updates where applicable.; Restrict automated tcpdump processing of untrusted captures until patched..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.