CVE-2017-11108

Name	CVE-2017-11108
Description	tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1090-1, DSA-3971-1
Debian Bugs	867718

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tcpdump (PTS)	bookworm	4.99.3-1	fixed
	trixie	4.99.5-2	fixed
	forky, sid	4.99.6-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
tcpdump	source	wheezy	4.9.0-1~deb7u2	DLA-1090-1
tcpdump	source	jessie	4.9.2-1~deb8u1	DSA-3971-1
tcpdump	source	stretch	4.9.2-1~deb9u1	DSA-3971-1
tcpdump	source	(unstable)	4.9.1-1		867718

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=1468504
Proposed patch: https://github.com/the-tcpdump-group/tcpdump/pull/617
https://github.com/the-tcpdump-group/tcpdump/commit/d9e65de3d94698ec90dbca42962a30dd2f0680e1 (4.9.1)