Critical
Security advisory
The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print().
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-13052
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:07 UTC · Revision 1
Source evidence
The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print().
osv:CVE-2017-13052
Complete source record
{
"id": "40df3cfeda5931619b12a3cb075d9b19e03e1416c58b3a54dd66af906653476b",
"url": "https://osv.dev/vulnerability/CVE-2017-13052",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-13052",
"summary": "The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print().",
"evidence": "osv:CVE-2017-13052",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2017-13052",
"aliases": [
"CVE-2017-13052"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/the-tcpdump-group/tcpdump",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "993a67c8e648bc8b19881e29a60f41273cfbee7b"
},
{
"fixed": "5d340a5ca6e420a70297cdbdf777333f18bfdab7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.9.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "5d340a5ca6e420a70297cdbdf777333f18bfdab7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"tcpdump-4.9.1",
"tcpdump-4.9.0",
"tcpdump-4.9.0-bp",
"tcpdump-4.7.0-bp",
"tcpdump-4.6.0-bp",
"tcpdump-4.6.0",
"tcpdump-4.5.0",
"tcpdump-3.8-bp",
"tcpdump-3.7.1",
"tcpdump-3.6.1",
"tcpdump-3.5.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-13052.json",
"vanir_signatures": [
{
"id": "CVE-2017-13052-8a931cb0",
"digest": {
"length": 485,
"function_hash": "232540731291277148770520456182036462916"
},
"source": "https://github.com/the-tcpdump-group/tcpdump/commit/5d340a5ca6e420a70297cdbdf777333f18bfdab7",
"target": {
"file": "print-cfm.c",
"function": "cfm_network_addr_print"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-13052-e4be6252",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80741822462077441123503422963199184776",
"150265555908817854105750076591173984920",
"201090491638076749405111983985118832302",
"15132964559816111241084487024918645654",
"6823738298761561224379280241936812706",
"327056877712625019181926988083714273239",
"238059367858253378455425665825975017676",
"186688970415895555014910777708615584904",
"83822530283452535160876622983499961331",
"143941441490390697267295529609839546801",
"152005731806711978043946382994559237914",
"46029461272162785421752664499464009865",
"291674265046957254903997936971976882156",
"133728706966789918636936938310637617590",
"165194018126357890257804646042374864591",
"153487549578650442071668972683637831840",
"60466690142558060555644709748607674937",
"162207167696064250715763758854224096924",
"159977122852790163271542853092652331099",
"200623859406511419853169001114125208684",
"185277800806865906708584170097942020162",
"228507359396161778641967714137889176977",
"157536928035373841109276507018729370468",
"205316541307473025297198188226625163932",
"323382930511496270419326466496138005160",
"251288258842993913982240343963169696240",
"56961560939322156693871682100314060658",
"117389890032957458971154799636246436735",
"163512650367956459129522207465886539014",
"340060252396749594433589744882227383569",
"243493027649654260348499606766819978390",
"325632913464661676582211132197644031851",
"285626316298976758187202063763394068566",
"104535032867544338110140263579457124772",
"30094850566290566754303488641533825293",
"240745086768054425757097496122829369768",
"9395181234138121465540071625295776081",
"313035326130967938293090546681618081401",
"160411019969075850623252656029467154206",
"58759855390860034822024603927379593231",
"186037650784257969430037123461113528018",
"156947453081944320649927394023279099679",
"187336350945291249891928149201368867277",
"235625617398205255566474064890310401351",
"278096600700421000357220850086419134705",
"116883193010023990608476468737250289876",
"210240921173319399228781462804237859203",
"52621746983056507435217092065663319124",
"68898828070657277399040415191913678539",
"266101808855159814341500180894444449167",
"284305812833742402090124447950746102500",
"261676423988628951342712455069875734952",
"169116614040360555801092475879572934897",
"29322825681409494274159577514512711441",
"329198458815204800680703944162628278773",
"205316541307473025297198188226625163932",
"247838775633360015907780489897699192500",
"156947453081944320649927394023279099679",
"187336350945291249891928149201368867277",
"235625617398205255566474064890310401351",
"278096600700421000357220850086419134705",
"116883193010023990608476468737250289876",
"210240921173319399228781462804237859203",
"52621746983056507435217092065663319124",
"284305812833742402090124447950746102500",
"261676423988628951342712455069875734952",
"84709343714629784651636225228239283628",
"186848264368413900166907238867269186943",
"189586465429336928909384022744067527862",
"324486746029549912334155125643073166615"
]
},
"source": "https://github.com/the-tcpdump-group/tcpdump/commit/5d340a5ca6e420a70297cdbdf777333f18bfdab7",
"target": {
"file": "print-cfm.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-13052-e54351e2",
"digest": {
"length": 8767,
"function_hash": "94995995543402001394332382772502495613"
},
"source": "https://github.com/the-tcpdump-group/tcpdump/commit/5d340a5ca6e420a70297cdbdf777333f18bfdab7",
"target": {
"file": "print-cfm.c",
"function": "cfm_print"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:09:04Z"
}
}
],
"modified": "2026-10-24T14:09:04.408820578Z",
"provider": "osv",
"references": [
"https://support.apple.com/HT208221",
"https://access.redhat.com/errata/RHEA-2018:0705",
"https://security.gentoo.org/glsa/201709-23",
"https://github.com/the-tcpdump-group/tcpdump/commit/5d340a5ca6e420a70297cdbdf777333f18bfdab7"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*"
],
"vendor_product": "tcpdump:tcpdump",
"extracted_events": [
{
"range": [
{
"last_affected": "4.9.1"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-13052",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443146,
"published_at": "2017-09-14T06:29:03.153+00:00"
}