CVE-2018-16301 Memory corruption in tcpdump

What is CVE-2018-16301?

CVE-2018-16301 is a high-severity memory corruption vulnerability in Tcpdump Tcpdump, published on 3 Oct 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.

Weakness: CWE-120, CWE-787, CWE-190

Which versions are affected by CVE-2018-16301?

It affects 1 product.

Products include Tcpdump Tcpdump.

How do I fix CVE-2018-16301?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-16301 being exploited?

There is no known exploitation of CVE-2018-16301 in the wild and no public exploit code.

Other vulnerabilities in Tcpdump Tcpdump

• CVE-2018-10103 tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2). Critical 9.8
• CVE-2018-10105 Denial of service in n/a Critical 9.8
• CVE-2017-12893 Memory corruption in n/a Critical 9.8
• CVE-2017-12894 Memory corruption in n/a Critical 9.8
• CVE-2017-12895 Memory corruption in n/a Critical 9.8

All Tcpdump Tcpdump vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2018-16301, AZL-8506, DEBIAN-CVE-2018-16301, GHSA-h8wh-rj39-x373, OESA-2022-1862, OESA-2022-1863 and 5 more.