RHSA-2020:4760 — Red Hat Security Advisory: tcpdump security, bug fix, and enhancement update

Fixed packages 3

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	tcpdump	14:4.9.3-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	tcpdump-debuginfo	14:4.9.3-1.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream	tcpdump-debugsource	14:4.9.3-1.el8

Vulnerabilities 24

Critical 9.8

CVE-2018-14881 Public exploit

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_REST…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-14882

The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-16228

The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-16230

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Critical 9.8

CVE-2018-16451

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIP…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14461

The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14462

The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14465

The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14467

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14468

The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-14470

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-16300

The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited re…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.5

CVE-2018-16452

The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
High 7.0

CVE-2018-14879 Public exploit

The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Low 1.6

CVE-2019-15166 Public exploit

lmp_print in tcpdump lacks certain boundary checks

lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-10103

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-10105

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14463

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a diffe…

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14464

The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14466

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14469 Public exploit

The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-14880 Public exploit

The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-16227

The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019
Unscored —

CVE-2018-16229

The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().

tcpdump tcpdump tcpdump Debian Ubuntu Alpine

Oct 3, 2019

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760430
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760445
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760447
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760449
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760453
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760455
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760457
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760458
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760461
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760463
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760464
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760468
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760504
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760505
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760506
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760507
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760509
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760512
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760513
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760514
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760516
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760517
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760518
report
https://bugzilla.redhat.com/show_bug.cgi?id=1760520
report
https://bugzilla.redhat.com/show_bug.cgi?id=1804063
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4760.json
report
https://access.redhat.com/security/cve/CVE-2018-10103
advisory
https://www.cve.org/CVERecord?id=CVE-2018-10103
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10103
report
https://access.redhat.com/security/cve/CVE-2018-10105
advisory
https://www.cve.org/CVERecord?id=CVE-2018-10105
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10105
report
https://access.redhat.com/security/cve/CVE-2018-14461
advisory
https://www.cve.org/CVERecord?id=CVE-2018-14461
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-14461
report
https://access.redhat.com/security/cve/CVE-2018-14462
advisory
https://www.cve.org/CVERecord?id=CVE-2018-14462

Red Hat Security Advisory: tcpdump security, bug fix, and enhancement update

Fixed packages 3

Vulnerabilities 24

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_REST…

The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.

The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIP…

The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().

The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().

The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().

The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited re…

The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.

The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().

lmp_print in tcpdump lacks certain boundary checks

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).

tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a diffe…

The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs().

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().

The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().

The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().

The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.

The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().

References