{"id":"CVE-2018-18407","aliases":["DEBIAN-CVE-2018-18407","EUVD-2018-10136","GHSA-7jw9-xj3x-9jqh","MGASA-2019-0094","UBUNTU-CVE-2018-18407","USN-5205-1","openSUSE-SU-2024:11426-1"],"status":"published","title":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0...","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01239,"percentile":0.69326,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-10-17T04:00:00Z","modified":"2026-10-23T18:03:56Z","fixes":[{"ecosystem":"Debian:12","package":"tcpreplay","fixed_in":["4.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tcpreplay","fixed_in":["4.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tcpreplay","fixed_in":["4.3.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tcpreplay","fixed_in":["3.4.4-2+deb8u1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tcpreplay","fixed_in":["4.2.6-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1.mga6"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-2+deb8u1ubuntu0.1~esm1"}]}],"versions":["3.4.4-2","3.4.4-2+deb8u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-1ubuntu0.1~esm1"}]}],"versions":["4.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-2+deb8u1ubuntu0.1~esm2"}]}],"versions":["3.4.4-2","3.4.4-2+deb8u1build0.16.04.1","3.4.4-2+deb8u1ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-1ubuntu0.1~esm4"}]}],"versions":["4.2.6-1","4.2.6-1ubuntu0.1~esm1","4.2.6-1ubuntu0.1~esm2","4.2.6-1ubuntu0.1~esm3"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-1ubuntu0.1~esm2"}]}],"versions":["4.3.2-1build1","4.3.2-1ubuntu0.1~esm1"],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1ubuntu0.1~esm1"}]}],"versions":["4.3.3-2","4.3.4-1"],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tcpreplay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.4-1.3"}]}],"bundled":11}],"products":[{"vendor":"broadcom","product":"tcpreplay"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/appneta/tcpreplay/issues/488","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/SegfaultMasters/covering360/blob/master/tcpreplay/README.md#user-content-heap-overflow-in-csum_replace4","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18407"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4V3SADKXUSHWTVAPU3WLXBDEQUHRA6ZO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLPY6W7Z7G6PF2JN4LXXHCACYLD4RBG6/"},{"url":"https://github.com/advisories/GHSA-7jw9-xj3x-9jqh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18407","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0094.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24148","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5UTDLO275Z67H3IN6UL57U6OAI4R3G5I/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-18407","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5205-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-13112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-12740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-24265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-24266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28487","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24266","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-18407","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","status":"published","published":"2018-10-17T04:00:00Z","modified":"2024-08-05T11:08:21.811Z","updated_at":"2026-11-02T14:35:11.799349Z"}],"euvd":[{"id":"EUVD-2018-10136","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","status":"published","published":"2018-10-17T04:00:00Z","modified":"2024-08-05T11:08:21Z","updated_at":"2026-11-03T02:39:36.317092Z"}],"ghsa":[{"id":"GHSA-7jw9-xj3x-9jqh","title":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0...","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","status":"published","published":"2022-05-13T01:02:56Z","modified":"2023-02-01T05:02:32Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:49:56.179573Z"}],"nvd":[{"id":"CVE-2018-18407","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","status":"published","published":"2018-10-17T04:29:00.643Z","modified":"2026-06-17T01:47:10.023Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:46.409324Z"}],"osv":[{"id":"CVE-2018-18407","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","status":"published","published":"2018-10-17T04:29:00.643Z","modified":"2026-10-20T10:51:21.725730674Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18407","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","status":"published","published":"2018-10-17T04:29:00.643Z","modified":"2026-10-23T18:03:56.132722409Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-18407","description":"A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.","status":"published","published":"2018-10-17T04:29:00Z","modified":"2026-02-04T04:04:40.345895Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"MGASA-2019-0094","title":"Updated tcpreplay packages fix security vulnerability","description":"An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer\nover-read was triggered in the function dlt_en10mb_encode() of the file\nplugins/dlt_en10mb/en10mb.c, due to inappropriate values in the function\nmemmove(). The length (pktlen + ctx -\u003e l2len) can be larger than source\nvalue (packet + ctx-\u003el2len) because the function fails to ensure the length\nof a packet is valid. This leads to Denial of Service. (CVE-2018-17974)\n\nA heap-based buffer over-read exists in the function fast_edit_packet() in\nthe file send_packets.c of Tcpreplay v4.3.0 beta1. This can lead to Denial\nof Service (DoS) and potentially Information Exposure when the application\nattempts to process a crafted pcap file. (CVE-2018-17580)\n\nTcpreplay v4.3.0 beta1 contains a heap-based buffer over-read. The\nget_next_packet() function in the send_packets.c file uses the memcpy()\nfunction unsafely to copy sequences from the source buffer pktdata to the\ndestination (*prev_packet)-\u003epktdata. This will result in a Denial of\nService (DoS) and potentially Information Exposure when the application\nattempts to process a file. (CVE-2018-17582)\n\nA heap-based buffer over-read was discovered in the tcpreplay-edit binary\nof Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The\nissue gets triggered in the function csum_replace4() in\nincremental_checksum.h, causing a denial of service. (CVE-2018-18407)\n\nA use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0\nbeta1. The issue gets triggered in the function post_args() at tcpbridge.c,\ncausing a denial of service or possibly unspecified other impact.\n(CVE-2018-18408)\n","status":"published","published":"2019-02-20T22:18:01Z","modified":"2026-04-16T04:40:52.741617241Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11426-1","title":"tcpreplay-4.3.4-1.3 on GA media","description":"These are all security issues fixed in the tcpreplay-4.3.4-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:23:05.929163Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5205-1","title":"tcpreplay vulnerabilities","description":"It was discovered that Tcpreplay incorrectly handled certain specially crafted\npacket capture input when processed by tcpprep. An attacker could possibly use\nthis issue to cause a denial of service. This issue only affected\nUbuntu 18.04 ESM. (CVE-2018-13112)\n\nIt was discovered that Tcpreplay incorrectly handled certain specially crafted\npacket capture input. An attacker could possibly use this issue to cause a denial\nof service or expose sensitive information. This issue only affected\nUbuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-17580, CVE-2018-17582)\n\nIt was discovered that Tcpreplay incorrectly handled certain specially crafted\npacket capture input. An attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2018-17974, CVE-2018-18407)\n\nIt was discovered that a use-after-free existed in Tcpreplay in the tcpbridge\nbinary. An attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-18408)\n\nIt was discovered that Tcpreplay incorrectly handled certain specially crafted\npacket capture input. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM\nand Ubuntu 20.04 ESM. (CVE-2018-20552, CVE-2018-20553)\n\nIt was discovered that a heap-based buffer over-read that existed in Tcpreplay\ncaused an application crash when tcprewrite or tcpreplay-edit received specially\ncrafted packet capture input. An attacker could possibly use this to cause a\ndenial of service or to expose sensitive information. This issue only affected\nUbuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12740)\n\nIt was discovered that Tcpreplay incorrectly handled certain specially crafted\npacket capture input when processed by tcpprep. An attacker could possibly use\nthis issue to cause a denial of service. This issue only affected\nUbuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-24265, CVE-2020-24266)\n\nIt was discovered that Tcpreplay incorrectly handled certain specially crafted\npacket capture input when processed by tcprewrite. An attacker could possibly\nuse this issue to cause a denial of service. This issue only affected Ubuntu\n22.04 ESM. (CVE-2022-27416)\n\nIt was discovered that Tcpreplay did not properly manage memory under certain\ncircumstances. If a user were tricked into opening a specially crafted packet\ncapture file, a remote attacker could possibly use this issue to cause\nTcpreplay crash, resulting in a denial of service, or possibly read sensitive\ndata. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and Ubuntu\n22.04 ESM. (CVE-2022-28487)\n","status":"published","published":"2022-10-04T11:15:02Z","modified":"2026-06-25T13:30:54.441262451Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}