CVE-2017-13049: The Rx protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-rx.c:ubik_print().

Security readout for executives and security teams

CVE-2017-13049 is a tcpdump packet-parsing flaw. Versions before 4.9.2 can read past a buffer while decoding Rx protocol data. The sources do not provide CVSS, detailed impact, or evidence of active exploitation. Exposure is most likely on systems using tcpdump before 4.9.2, especially monitoring, troubleshooting, or analysis hosts that inspect untrusted network traffic or packet capture files containing Rx protocol data. Prioritize normal security patching, with higher urgency for network monitoring and incident response systems that parse untrusted traffic. The business risk is limited by absent exploitation evidence, but tcpdump is commonly used in sensitive operational workflows. Mitigation focus: Update tcpdump through the operating system vendor's supported security packages.; For direct builds, move tcpdump to 4.9.2 or later.; Review Gentoo, Debian, Apple, and Red Hat advisories for package-specific guidance..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.