PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7925 Tcpdump CVE debrief

CVE-2016-7925 is a critical buffer overflow in tcpdump’s compressed SLIP parser, affecting versions before 4.9.0. The issue is identified in print-sl.c:sl_if_print() and was assigned a CVSS 3.0 score of 9.8, reflecting high-impact conditions with no privileges or user interaction required.

Vendor
Tcpdump
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Security teams, Linux distribution maintainers, and operators who use tcpdump 4.8.1 or earlier should prioritize this. It is especially relevant wherever tcpdump is used to inspect packet captures or network data as part of normal operations.

Technical summary

NVD describes the flaw as a buffer overflow in the compressed SLIP parser within tcpdump’s print-sl.c:sl_if_print() routine. The affected range is tcpdump versions before 4.9.0, with NVD’s CPE criteria marking versions through 4.8.1 as vulnerable. The weakness is classified as CWE-119.

Defensive priority

Critical. The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, so this should be treated as an urgent upgrade item for any exposed or broadly deployed tcpdump installation.

Recommended defensive actions

  • Upgrade tcpdump to 4.9.0 or later, or install the vendor-maintained fixed package for your distribution.
  • Inventory systems running tcpdump 4.8.1 or earlier and confirm remediation status.
  • Review Debian, Red Hat, and Gentoo advisory pages linked from the CVE record to align with your distribution’s fix path.
  • Avoid relying on outdated tcpdump binaries for analyzing untrusted capture data until patched.
  • Validate that security baselines and package management policies prevent reinstallation of vulnerable tcpdump versions.

Evidence notes

This debrief is based on the NVD CVE record and the CVE description stating a compressed SLIP parser buffer overflow in tcpdump before 4.9.0. NVD lists the vulnerable CPE as tcpdump versions through 4.8.1 and assigns CVSS 3.0 9.8 with CWE-119. The linked Debian, Red Hat, and Gentoo advisories support the remediation context.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7925 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7925

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7925 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7925

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.