CVE-2020-8037

The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces.

Security Fix(es):

• tcpdump: ppp decapsulator can be convinced to allocate a large amount of memory (CVE-2020-8037)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces.

Security Fix(es):

• tcpdump: ppp decapsulator can be convinced to allocate a large amount of memory (CVE-2020-8037)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. (CVE-2020-8037)

This update for tcpdump fixes the following issues:

• CVE-2020-8037: Fixed an issue where PPP decapsulator did not allocate the right buffer size (bsc#1178466).

This update was imported from the SUSE:SLE-15:Update update project.

This update for tcpdump fixes the following issues:

• CVE-2020-8037: Fixed an issue where PPP decapsulator did not allocate the right buffer size (bsc#1178466).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the tcpdump-4.99.1-1.2 package on the GA media of openSUSE Tumbleweed.

This update for tcpdump fixes the following issues:

• CVE-2020-8037: Fixed an issue where PPP decapsulator did not allocate the right buffer size (bsc#1178466).

This update for tcpdump fixes the following issues:

• CVE-2020-8037: Fixed an issue where PPP decapsulator did not allocate the right buffer size (bsc#1178466).

The previous update of tcpdump already fixed variuous Buffer overflow/overread vulnerabilities [bsc#1153098, bsc#1153332]

• CVE-2017-16808 (AoE)
• CVE-2018-14468 (FrameRelay)
• CVE-2018-14469 (IKEv1)
• CVE-2018-14470 (BABEL)
• CVE-2018-14466 (AFS/RX)
• CVE-2018-14461 (LDP)
• CVE-2018-14462 (ICMP)
• CVE-2018-14465 (RSVP)
• CVE-2018-14464 (LMP)
• CVE-2019-15166 (LMP)
• CVE-2018-14880 (OSPF6)
• CVE-2018-14882 (RPL)
• CVE-2018-16227 (802.11)
• CVE-2018-16229 (DCCP)
• CVE-2018-14467 (BGP)
• CVE-2018-14881 (BGP)
• CVE-2018-16230 (BGP)
• CVE-2018-16300 (BGP)
• CVE-2018-14463 (VRRP)
• CVE-2019-15167 (VRRP)
• CVE-2018-14879 (tcpdump -V)
• CVE-2018-16228 (HNCP) is a duplicate of the already fixed CVE-2019-1010220
• CVE-2018-16301 (fixed in libpcap)
• CVE-2018-16451 (SMB)
• CVE-2018-16452 (SMB)
• CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled)
• CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled)

It was discovered that tcpdump incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2018-16301)

It was discovered that tcpdump incorrectly handled certain captured data. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-8037)

USN-5331-1 fixed several vulnerabilities in tcpdump. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details: It was discovered that tcpdump incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2018-16301)

It was discovered that tcpdump incorrectly handled certain captured data. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-8037)