PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7992 Tcpdump CVE debrief

CVE-2016-7992 is a critical memory-corruption flaw in tcpdump’s Classical IP over ATM parsing path. The vulnerable code is in print-cip.c:cip_if_print(), and the issue is rated 9.8 with confidentiality, integrity, and availability impact.

Vendor
Tcpdump
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Security teams, Linux distribution maintainers, and anyone running tcpdump or tcpdump-derived packages should pay attention, especially where the tool processes untrusted packet captures or live network traffic. Organizations that rely on packet analysis in incident response, monitoring, or automation should prioritize patching.

Technical summary

The CVE describes a buffer overflow in tcpdump’s Classical IP over ATM parser, specifically in print-cip.c:cip_if_print(). NVD maps the weakness to CWE-119 and assigns CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE description states tcpdump versions before 4.9.0 are affected; NVD’s affected-version data lists tcpdump through 4.8.1.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade tcpdump to a fixed release, or install the vendor-maintained security update for your distribution.
  • Confirm deployed package versions across hosts, containers, and appliances that include tcpdump.
  • If tcpdump must handle untrusted captures, isolate it in a restricted environment and minimize privileges.
  • Review automation or scheduled jobs that parse packet captures and ensure they use patched binaries.
  • Track vendor advisories from your distribution for backported fixes and package-specific remediation guidance.

Evidence notes

The CVE record and NVD entry identify a buffer overflow in tcpdump’s Classical IP over ATM parser at print-cip.c:cip_if_print(). The supplied NVD metadata lists a CVSS 3.0 score of 9.8 and CWE-119. The CVE description says affected releases are before 4.9.0, while NVD’s version-range data lists vulnerability through 4.8.1. Referenced vendor and distribution advisories include Debian DSA-3775, Red Hat RHSA-2017:1871, and Gentoo GLSA 201702-30.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7992 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7992

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7992 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7992

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.