CVE-2017-13690: The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.

Security readout for executives and security teams

Tcpdump versions before 4.9.2 can read beyond a packet buffer while parsing IKEv2 traffic. This affects a network analysis tool, not a listening business application. Risk is highest where staff or automated systems inspect untrusted packet captures or live network traffic using older tcpdump builds. Systems with tcpdump earlier than 4.9.2, including vendor-packaged builds referenced by Gentoo, Debian, Apple, and Red Hat sources. Exposure requires tcpdump to parse IKEv2 packets from live traffic or capture files. Treat as a hygiene fix for security and operations systems. It is not KEV-listed in the bundle, but tcpdump is widely deployed and often handles untrusted network data, so remediation should follow normal patch cycles. Mitigation focus: Update tcpdump using the relevant vendor security advisory.; Use tcpdump 4.9.2 or later where self-managed builds are used.; Check operating-system vendor guidance for backported fixes..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.