Base Score

HIGH7.5

CVE-2017-12997

The LLDP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-lldp.c:lldp_private_8021_print().

VectorNETWORK

Published Bycve@mitre.org

Published DateSep 14, 2017, 06:29

Weakness Type (CWE):CWE-835

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

CRITICAL

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH

References

http://www.debian.org/security/2017/dsa-3971
http://www.securityfocus.com/bid/100914
http://www.securitytracker.com/id/1039307
http://www.tcpdump.org/tcpdump-changes.txt
https://access.redhat.com/errata/RHEA-2018:0705
https://github.com/the-tcpdump-group/tcpdump/commit/34cec721d39c76be1e0a600829a7b17bdfb832b6
https://security.gentoo.org/glsa/201709-23
https://support.apple.com/HT208221

Base Score

HIGH7.5

Weakness Type (CWE):CWE-835

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

CRITICAL

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH