PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7924 Tcpdump CVE debrief

CVE-2016-7924 describes a critical buffer overflow in tcpdump’s ATM parser, specifically in print-atm.c:oam_print(), affecting tcpdump versions before 4.9.0. NVD rates the issue CVSS 3.0 9.8 with network attack vector, no privileges required, and no user interaction, making patching or package replacement a high priority for anyone relying on tcpdump to inspect packet captures.

Vendor
Tcpdump
Product
CVE-2016-7924
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Security teams, Linux distribution maintainers, and administrators who deploy tcpdump for packet capture or troubleshooting should treat this as urgent. It is also relevant to any environment where tcpdump is installed on servers, appliances, or analyst workstations and may process untrusted capture data.

Technical summary

NVD identifies the weakness as CWE-119 and lists affected tcpdump versions through 4.8.1. The flaw is in the ATM parsing path, where malformed input can trigger a buffer overflow in oam_print(). The published CVSS vector indicates a remotely reachable, low-complexity issue with no authentication or user interaction required and potential high impact on confidentiality, integrity, and availability.

Defensive priority

Urgent

Recommended defensive actions

  • Upgrade tcpdump to 4.9.0 or install your vendor’s fixed package immediately.
  • Confirm no hosts remain on tcpdump 4.8.1 or earlier, including embedded or long-lived appliance images.
  • Apply distributor advisories and security errata referenced for this CVE, such as Debian, Red Hat, and Gentoo package updates.
  • If tcpdump is not required on a system, remove it or restrict access to reduce exposure.
  • Validate remediation by checking installed package versions after patching.

Evidence notes

The NVD record and CVE metadata state that the issue is a buffer overflow in print-atm.c:oam_print() and that versions through 4.8.1 are vulnerable. The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, supporting urgent prioritization. Officially listed remediation references include Debian DSA-3775, Red Hat RHSA-2017:1871, and Gentoo GLSA 201702-30.

Official resources

CVE record published on 2017-01-28; NVD entry last modified on 2026-05-13. The analysis here uses those published CVE timeline fields and official references only.