CVE-2017-14266

NameCVE-2017-14266
Descriptiontcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6160.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tcpreplay (PTS)wheezy3.4.3-2+wheezy1vulnerable
wheezy (security)3.4.3-2+wheezy2fixed
jessie3.4.4-2+deb8u1fixed
stretch3.4.4-3fixed
buster, sid4.2.6-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tcpreplaysource(unstable)3.4.4-3medium
tcpreplaysourcejessie3.4.4-2+deb8u1medium
tcpreplaysourcewheezy3.4.3-2+wheezy2medium

Notes

Fixed by http://launchpadlibrarian.net/270778908/tcpreplay_3.4.4-2_3.4.4-3.diff.gz
Not a duplicate of CVE-2016-6160 the detailed MITRE description, but both issues
are addressed with the same patch:
Patch enforce-maxpacket.patch addresses the issue

Search for package or bug name: Reporting problems