CVE-2018-16301

HIGH

tcpdump < 4.99.0 - Buffer Overflow via -F Command-Line Argument

Title source: llm
STIX 2.1

Description

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.

References (1)

Core 1

Scores

CVSS v3 7.8
EPSS 0.0063
EPSS Percentile 45.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-120 CWE-190 CWE-787
Status published
Products (1)
tcpdump/tcpdump < 4.99.0
Published Oct 03, 2019
Tracked Since Feb 18, 2026