Multiple buffer overflows, and one integer overflow, in protocol decoding were found that may cause incorrect decoding, segmentation fault or (in the case of integer overflow) an infinite loop. These issues can be be exploited either locally, by making the target user decode a crafted .pcap file using tcpdump, or remotely by sending crafted packets to the network segment where the target system is running tcpdump decoding the live packet capture. Ability to send crafted packets to the target network segment is limited by the protocols' ability to cross network segments, or presence of firewall rules.

Upstream changelog:

http://www.tcpdump.org/tcpdump-changes.txt

The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:oamprint().

The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print-mpls.c:mplsprint().

The SNMP parser in tcpdump before 4.9.0 has a buffer overflow in print-snmp.c:asn1parse().

The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933print(), a different vulnerability than CVE-2017-5482.

The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print-otv.c:otvprint().

The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:sigprint().

The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-80211.c:ieee80211radioprint().

The PIM parser in tcpdump before 4.9.0 has a buffer overflow in print-pim.c:pimv2checkchecksum().

The Ethernet parser in tcpdump before 4.9.0 has a buffer overflow in print-ether.c:ethertypeprint().

The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtpprint().

The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootpprint().

The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in addrtoname.c:lookupnsap().

The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1printframe().

The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933print(), a different vulnerability than CVE-2016-8575.

The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cipifprint().

A bug in util-print.c:reltsprint() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).

The compressed SLIP parser in tcpdump before 4.9.0 has a buffer overflow in print-sl.c:slifprint().

The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcpprint().

The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions.

The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:vatprint().

The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:udpprint().

In tcpdump before 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:etherprint().

The PPP parser in tcpdump before 4.9.0 has a buffer overflow in print-ppp.c:ppphdlcifprint().

The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftpprint().

The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniperparseheader().

The LLC/SNAP parser in tcpdump before 4.9.0 has a buffer overflow in print-llc.c:llcprint().

The IPComp parser in tcpdump before 4.9.0 has a buffer overflow in print-ipcomp.c:ipcompprint().

The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcpprint().

The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calmfastprint().