PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7923 Tcpdump CVE debrief

CVE-2016-7923 is a critical memory-corruption flaw in tcpdump’s ARP parser. According to the CVE record, the issue is a buffer overflow in print-arp.c:arp_print() affecting tcpdump versions before 4.9.0. Because tcpdump is commonly used to inspect network traffic, systems that process untrusted packet data should treat this as a high-priority upgrade item.

Vendor
Tcpdump
Product
CVE-2016-7923
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Anyone running tcpdump 4.8.1 or earlier, especially network administrators, SOC analysts, incident responders, and appliance or distro maintainers that ship tcpdump for packet inspection on untrusted traffic.

Technical summary

The supplied CVE and NVD data describe a buffer overflow in tcpdump’s ARP parsing path, specifically print-arp.c:arp_print(). NVD assigns CWE-119 and CVSS v3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a remotely reachable parsing flaw with severe potential impact if triggered while tcpdump processes crafted ARP data.

Defensive priority

Immediate / critical. Upgrade or replace affected tcpdump builds as soon as possible, and treat any instance processing untrusted packet captures or live network traffic as exposed until verified patched.

Recommended defensive actions

  • Upgrade tcpdump to 4.9.0 or a vendor-patched package that explicitly fixes CVE-2016-7923.
  • Check all servers, troubleshooting hosts, appliances, and security tooling for bundled tcpdump versions at or below 4.8.1.
  • Apply the relevant vendor advisories from Debian, Red Hat, and Gentoo to ensure distro-specific backports are installed.
  • Limit tcpdump usage on untrusted traffic to trusted operators and controlled systems until patching is complete.

Evidence notes

The core facts come from the supplied CVE description and NVD record: tcpdump before 4.9.0 has a buffer overflow in print-arp.c:arp_print(). NVD maps the issue to CWE-119 and rates it CVSS 3.0 9.8 with network reachability and high confidentiality, integrity, and availability impact. The supplied references also include Debian, Red Hat, and Gentoo advisories, supporting that multiple vendors issued remediation guidance. No KEV entry is present in the supplied enrichment, and the corpus does not include exploit code or upstream patch details.

Official resources

The CVE was published on 2017-01-28 in the supplied record. The supplied NVD source item shows a later modification timestamp of 2026-05-13, which should be treated as record maintenance timing rather than the original vulnerability date. D