Description
Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tcpdump | 3.9.5-2 | — |
| Debian 13 | tcpdump | 3.9.5-2 | — |
| Debian 12 | tcpdump | 3.9.5-2 | — |
| Debian 3.1 | tcpdump | 3.8.3-5sarge2 | DSA-1272-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | arpwatch | 14:2.1a13-18.el5 | RHSA-2007:0368 |
| RHEL 5 | libpcap +1 | 14:0.9.4-11.el5 | RHSA-2007:0368 |
| RHEL 5 | tcpdump | 14:3.9.4-11.el5 | RHSA-2007:0368 |
| RHEL 4 | arpwatch | 14:2.1a13-12.el4 | RHSA-2007:0387 |
| RHEL 4 | libpcap | 14:0.8.3-12.el4 | RHSA-2007:0387 |
| RHEL 4 | tcpdump | 14:3.8.2-12.el4 | RHSA-2007:0387 |
Advisories 3
- RHSA-2007:0368 Red Hat Security Advisory: tcpdump security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0387 Red Hat Security Advisory: tcpdump security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1272-1 tcpdump - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2007:0387 vendor-advisory
- ADV-2007-4238 vdb-entry
- 22772 vdb-entry
- TA07-352A third-party-advisory
- 32427 vdb-entry
- DSA-1272 vendor-advisory
- 27580 third-party-advisory
- FEDORA-2007-347 vendor-advisory
- USN-429-1 vendor-advisory
- 28136 third-party-advisory
- ADV-2007-0793 vdb-entry
- 24354 third-party-advisory
- tcpdump-print80211c-bo(32749) vdb-entry
- http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c?r1=1.31.2.11&r2=1.31.2.12
- https://issues.rpath.com/browse/RPL-1100
- https://bugs.gentoo.org/show_bug.cgi?id=168916
- RHSA-2007:0368 vendor-advisory
- oval:org.mitre.oval:def:9520 vdb-entry signature
- 24423 third-party-advisory
- 20070301 tcpdump: off-by-one heap overflow in 802.11 printer mailing-list
- MDKSA-2007:056 vendor-advisory
- APPLE-SA-2007-12-17 vendor-advisory
- 24451 third-party-advisory
- MDKSA-2007:155 vendor-advisory
- 24610 third-party-advisory
- 24583 third-party-advisory
- 1017717 vdb-entry
- http://docs.info.apple.com/article.html?artnum=307179
- FEDORA-2007-348 vendor-advisory
- TLSA-2007-46 vendor-advisory
- http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c
- 24318 third-party-advisory