CVE-2017-5342

Publication date 27 January 2017

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

In tcpdump before 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print().

Status

Package Ubuntu Release Status
tcpdump 16.10 yakkety
Fixed 4.9.0-1ubuntu1~ubuntu16.10.1
16.04 LTS xenial
Fixed 4.9.0-1ubuntu1~ubuntu16.04.1
14.04 LTS trusty
Fixed 4.9.0-1ubuntu1~ubuntu14.04.1
12.04 LTS precise
Fixed 4.9.0-1ubuntu1~ubuntu12.04.1

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-3205-1
    • tcpdump vulnerabilities
    • 21 February 2017

Other references