CVE-2017-13052: The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print().

Security readout for executives and security teams

CVE-2017-13052 is a tcpdump parsing flaw. Versions before 4.9.2 can read past a buffer while decoding CFM network data. For most organizations this is mainly a risk to systems or analysts using tcpdump on untrusted traffic or packet captures, not an internet-facing service risk. Exposure is most likely on endpoints, servers, appliances, or forensic workstations running tcpdump before 4.9.2, especially where tcpdump processes untrusted live traffic or packet capture files containing CFM data. Treat this as a patch hygiene item unless tcpdump is heavily used in incident response, packet inspection, or network monitoring workflows. No active exploitation is supported by the supplied sources, but vulnerable tooling can still create avoidable operational risk. Mitigation focus: Inventory installed tcpdump versions across Linux, macOS, appliances, and analysis workstations.; Upgrade tcpdump to 4.9.2 or a vendor-fixed package where available.; Apply relevant vendor advisories from Debian, Gentoo, Apple, or Red Hat..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.