CVE-2015-2154 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Tcpdump

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125 — Out-of-bounds Read10 documents7 sources

Severity

5.0MEDIUMNVD

EPSS

1.8%

top 17.31%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Tcpdump Debian Tcpdump

Timeline

PublishedMar 24

Latest updateMay 14

Description

The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/tcpdump< tcpdump 4.6.2-4 (bookworm)

▶Debiantcpdump/tcpdump< 4.6.2-4+3

▶NVDtcpdump/tcpdump4.7.0

🔴Vulnerability Details

GHSA

GHSA-78vx-8c5h-72jr: The osi_print_cksum function in print-isoclns↗2022-05-14

▶

OSV

CVE-2015-2154: The osi_print_cksum function in print-isoclns↗2015-03-24

▶

📋Vendor Advisories

Ubuntu

tcpdump vulnerabilities↗2015-04-27

▶

Red Hat

tcpdump: ethernet printer osi_print_cksum() missing sanity checks out-of-bounds read↗2015-03-09

▶

Debian

CVE-2015-2154: tcpdump - The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdu...↗2015

▶

💬Community

Bugzilla

CVE-2015-0261 CVE-2015-2154 CVE-2015-2153 CVE-2015-2155 tcpdump: various flaws [fedora-all]↗2015-03-13

▶

Bugzilla

CVE-2015-2154 tcpdump: ethernet printer osi_print_cksum() missing sanity checks out-of-bounds read↗2015-03-13

▶

Bugzilla

CVE-2015-2155 tcpdump: force printer vulnerability↗2015-03-13

▶

Bugzilla

CVE-2015-2153 tcpdump: tcp printer rpki_rtr_pdu_print() missing length check↗2015-03-13

▶