cbcvebase.
CVE-2018-20552
published 2018-12-28

CVE-2018-20552: Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c.

PriorityP431high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
1.25%
65.7th percentile
Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c.

Affected

10 ranges
VendorProductVersion rangeFixed in
broadcomtcpreplay< 4.3.14.3.1
broadcomtcpreplay>= 0 < 4.3.1-14.3.1-1
broadcomtcpreplay>= 0 < 4.3.1-14.3.1-1
broadcomtcpreplay>= 0 < 4.3.1-14.3.1-1
broadcomtcpreplay>= 0 < 4.3.1-14.3.1-1
broadcomtcpreplay>= 0 < 3.4.4-2+deb8u1ubuntu0.1~esm23.4.4-2+deb8u1ubuntu0.1~esm2
broadcomtcpreplay>= 0 < 4.2.6-1ubuntu0.1~esm44.2.6-1ubuntu0.1~esm4
broadcomtcpreplay>= 0 < 4.3.2-1ubuntu0.1~esm24.3.2-1ubuntu0.1~esm2
broadcomtcpreplay>= 0 < 4.3.4-1ubuntu0.1~esm14.3.4-1ubuntu0.1~esm1
debiantcpreplay< tcpreplay 4.3.1-1 (bookworm)tcpreplay 4.3.1-1 (bookworm)

CVSS provenance

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.