tcpdump vulnerabilities

The ISAKMP parser in tcpdump before version 4.9.0 has a buffer overflow in the ikev2_e_print() function in print-isakmp.c.

The IPv6 parser in tcpdump before version 4.9.0 has a buffer overflow in the ip6_print() function in print-ip6.c.

The BOOTP parser in tcpdump before version 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().

The ISO CLNS parser in tcpdump before version 4.9.0 has a buffer overflow in the clnp_print() function in print-isoclns.c.

The Q.933 parser in tcpdump before version 4.9.0 has a buffer overflow in print-fr.c:q933_print(), which is a different vulnerability than CVE-2017-5482.

The FRF.15 parser in tcpdump before version 4.9.0 has a buffer overflow in print-fr.c:frf15_print().

A bug in util-print.c:relts_print() in tcpdump before version 4.9.0 could lead to a buffer overflow in multiple protocol parsers, including DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, and PIM.

The Classical IP over ATM parser in tcpdump before version 4.9.0 has a buffer overflow in the cip_if_print() function in print-cip.c.

The GeoNetworking parser in tcpdump before version 4.9.0 has a buffer overflow in print-geonet.c in multiple functions.

The CALM FAST parser in tcpdump before version 4.9.0 has a buffer overflow in the calm_fast_print() function.

The TFTP parser in tcpdump before version 4.9.0 has a buffer overflow in print-tftp.c:tftp_print().

The BOOTP parser in tcpdump before version 4.9.0 has a buffer overflow in the bootp_print() function.

The TCP parser in tcpdump before version 4.9.0 has a buffer overflow in the tcp_print() function in print-tcp.c.

The IP parser in tcpdump before version 4.9.0 has a buffer overflow in print-ip.c, in multiple functions.

The AppleTalk parser in tcpdump before version 4.9.0 has a buffer overflow in print-atalk.c in multiple functions.

The STP parser in tcpdump before version 4.9.0 has a buffer overflow in print-stp.c in multiple functions.

The GRE parser in tcpdump before version 4.9.0 has a buffer overflow in print-gre.c in multiple functions.

The ZeroMQ parser in tcpdump before version 4.9.0 has an integer overflow in the zmtp1_print_frame() function.

The VAT parser in tcpdump before version 4.9.0 has a buffer overflow in the vat_print() function in print-udp.c.

The UDP parser in tcpdump before version 4.9.0 has a buffer overflow in the udp_print() function.

The RTP parser in tcpdump before version 4.9.0 has a buffer overflow in the rtp_print() function in print-udp.c.

The RTCP parser in tcpdump before version 4.9.0 has a buffer overflow in print-udp.c:rtcp_print().

The PPP parser in tcpdump before version 4.9.0 has a buffer overflow in the ppp_hdlc_if_print() function.

The PIM parser in tcpdump before version 4.9.0 has a buffer overflow in print-pim.c:pimv2_check_checksum().

The MPLS parser in tcpdump before version 4.9.0 has a buffer overflow in the mpls_print() function in print-mpls.c.

The LLC/SNAP parser in tcpdump before version 4.9.0 has a buffer overflow in the llc_print() function in print-llc.c.

The PPPoE ATM parser in tcpdump before version 4.9.0 has a buffer overflow in the juniper_parse_header() function.

The IPComp parser in tcpdump before version 4.9.0 has a buffer overflow in the ipcomp_print() function in print-ipcomp.c.

The IEEE 802.11 parser in tcpdump before version 4.9.0 has a buffer overflow in the ieee802_11_radio_print() function.

The Ethernet parser in tcpdump before version 4.9.0 has a buffer overflow in print-ether.c:ethertype_print().

The compressed SLIP parser in tcpdump before version 4.9.0 has a buffer overflow in the sl_if_print() function in print-sl.c.

The ATM parser in tcpdump before version 4.9.0 has a buffer overflow in the function print-atm.c:oam_print().

The ARP parser in tcpdump before version 4.9.0 has a buffer overflow in the arp_print() function in print-arp.c.

The AH parser in tcpdump before version 4.9.0 has a buffer overflow in the ah_print() function in print-ah.c.

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.