PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7975 Tcpdump CVE debrief

CVE-2016-7975 is a critical buffer overflow in tcpdump's TCP parser, specifically in print-tcp.c:tcp_print(). NVD rates the issue 9.8 (CVSS 3.0) with network attack vector, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability. The official record lists tcpdump versions through 4.8.1 as vulnerable; remediation is to move to a fixed release such as 4.9.0 or later.

Vendor
Tcpdump
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Security teams, Linux/Unix administrators, SOC and incident response teams, and package maintainers who run tcpdump on systems that analyze untrusted packet captures or live network traffic.

Technical summary

The vulnerable code path is the TCP parser in print-tcp.c:tcp_print(). NVD classifies the weakness as CWE-119 (buffer overflow). The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable parsing flaw that can be triggered without privileges or user interaction and can have high impact. NVD's vulnerable CPE scope covers tcpdump up to 4.8.1.

Defensive priority

High. Because this is a pre-authentication parsing flaw in a common packet analysis tool, systems that process untrusted traffic or capture files should be prioritized for patching and version verification.

Recommended defensive actions

  • Inventory all tcpdump installations and identify affected versions.
  • Upgrade tcpdump to 4.9.0 or later, or apply the vendor/distro package update referenced by your platform.
  • Prioritize systems that inspect untrusted packet captures or live network traffic.
  • Verify remediation with package/version checks after updating.
  • If patching is delayed, reduce exposure by avoiding untrusted captures on affected binaries and isolating impacted systems until fixed.

Evidence notes

Primary evidence comes from the official CVE and NVD records, which identify the TCP parser buffer overflow in tcpdump, the print-tcp.c:tcp_print() location, the CWE-119 classification, the CVSS 3.0 9.8 score, and the vulnerable version range through 4.8.1. The source metadata also lists downstream advisories from Debian, Red Hat, Gentoo, SecurityFocus, SecurityTracker, and a Debian bug thread as corroborating references.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7975 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7975

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7975 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7975

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.