CVE-2017-13045: The VQP parser in tcpdump before 4.9.2 has a buffer over-read in print-vqp.c:vqp_print().

Security readout for executives and security teams

CVE-2017-13045 is a tcpdump flaw where specially crafted VQP data can make vulnerable tcpdump versions read past valid memory. In business terms, systems using tcpdump before 4.9.2 may be exposed when inspecting traffic or packet captures. The supplied sources do not show active exploitation. Exposure is likely on Linux, Unix, macOS, appliance, or security-monitoring systems that include tcpdump before 4.9.2 and parse VQP traffic or packet captures. Automated monitoring, incident response workstations, and shared packet-analysis environments deserve priority review. Treat this as a high-priority hygiene fix for systems using tcpdump, especially security tooling and packet-analysis hosts. The severity is critical, but the supplied evidence does not show known active exploitation, so prioritize rapid patching over emergency incident response unless local indicators exist. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Gentoo, Debian, Apple, or Red Hat vendor updates.; Prioritize systems that automatically inspect network traffic or packet captures..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.