CVE-2017-13042: The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv6_print().

Security readout for executives and security teams

CVE-2017-13042 is a tcpdump parsing flaw fixed before version 4.9.2. A malformed HNCP/DHCPv6 packet or capture could make tcpdump read past the intended buffer while decoding traffic. This is most relevant to systems and analysts that inspect untrusted network traffic or packet captures. Exposure is likely where tcpdump before 4.9.2 is installed and used to inspect live traffic or externally supplied packet captures, including security workstations, network sensors, and server troubleshooting environments. Prioritize routine remediation for security tooling and network monitoring hosts. This is not shown as actively exploited, but vulnerable packet analyzers can be exposed to adversary-controlled traffic during investigations. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant OS vendor advisories from Debian, Gentoo, Apple, or Red Hat.; Restrict use of vulnerable tcpdump on untrusted packet captures..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.