CVE-2019-15166

nvd nist

Published: Oct 3, 2019Modified: Dec 3, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.

Affected (19)

Products: Tcpdump: Tcpdump · Apple: Mac Os X · Debian: Debian Linux · +5 more

Show all products

Tcpdump: Tcpdump · Apple: Mac Os X · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Leap · Redhat: Enterprise Linux · Netapp: Cloud Backup, Hci Management Node, Solidfire · Canonical: Ubuntu Linux

1 product

1 product

1 product

1 product

1 product

1 product

3 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tcpdump Tcpdump	Before 4.9.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.15.2

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Hci Management Node	All versions
Netapp Solidfire	All versions

Configuration H

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (32)

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2019/Dec/26

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/the-tcpdump-group/tcpdump/commit/0b661e0aa61850234b64394585cf577aac570bf4

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Dec/23

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Oct/28

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20200120-0001/

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT210788

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4252-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4252-2/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4547

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html