crítica
CVE-2019-15167
tcpdump: Buffer over-read in vrrp_print() function in print-vrrp.c
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Amazon (media), Ubuntu (media), Red Hat (baja).
Descripción
The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | tcpdump | 4.9.3-r0 |
| alpine 3.11 | tcpdump | 4.9.3-r0 |
| alpine 3.12 | tcpdump | 4.9.3-r0 |
| alpine 3.13 | tcpdump | 4.9.3-r0 |
| alpine 3.14 | tcpdump | 4.9.3-r0 |
| alpine 3.15 | tcpdump | 4.9.3-r0 |
| alpine 3.16 | tcpdump | 4.9.3-r0 |
| alpine 3.17 | tcpdump | 4.9.3-r0 |
| alpine 3.18 | tcpdump | 4.9.3-r0 |
| alpine 3.19 | tcpdump | 4.9.3-r0 |
| alpine 3.20 | tcpdump | 4.9.3-r0 |
| alpine 3.21 | tcpdump | 4.9.3-r0 |
Mostrar las 35 entradas de 32 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | tcpdump | 4.9.3-r0 |
| alpine 3.11 | tcpdump | 4.9.3-r0 |
| alpine 3.12 | tcpdump | 4.9.3-r0 |
| alpine 3.13 | tcpdump | 4.9.3-r0 |
| alpine 3.14 | tcpdump | 4.9.3-r0 |
| alpine 3.15 | tcpdump | 4.9.3-r0 |
| alpine 3.16 | tcpdump | 4.9.3-r0 |
| alpine 3.17 | tcpdump | 4.9.3-r0 |
| alpine 3.18 | tcpdump | 4.9.3-r0 |
| alpine 3.19 | tcpdump | 4.9.3-r0 |
| alpine 3.20 | tcpdump | 4.9.3-r0 |
| alpine 3.21 | tcpdump | 4.9.3-r0 |
| alpine 3.22 | tcpdump | 4.9.3-r0 |
| alpine 3.23 | tcpdump | 4.9.3-r0 |
| alpine 3.24 | tcpdump | 4.9.3-r0 |
| alpine 3.9 | tcpdump | 4.9.3-r0 |
| alpine edge | tcpdump | 4.9.3-r0 |
| amazon linux 1 | tcpdump | 14:4.9.2-4.24.amzn1 |
| amazon linux 1 | tcpdump-debuginfo | 14:4.9.2-4.24.amzn1 |
| amazon linux 2 | tcpdump | 14:4.9.2-4.amzn2.1.0.1 |
| amazon linux 2 | tcpdump-debuginfo | 14:4.9.2-4.amzn2.1.0.1 |
| debian 10 | tcpdump | 4.9.3-1~deb10u1 |
| debian 11 | tcpdump | 4.9.3-1 |
| debian 12 | tcpdump | 4.9.3-1 |
| debian 13 | tcpdump | 4.9.3-1 |
| debian 14 | tcpdump | 4.9.3-1 |
| echo | tcpdump | 4.9.3-1 |
| Red Hat | tcpdump | sin corrección indicada |
| seal Red Hat 6 | seal-tcpdump | 14:4.0.0-11.20090921gitdf3cb4.2.el6+sp999 |
| seal Red Hat 6 | tcpdump | 14:4.0.0-11.20090921gitdf3cb4.2.el6+sp999 |
| ubuntu 14.04-ESM | tcpdump | 4.9.3-0ubuntu0.14.04.1+esm1 |
| ubuntu 16.04 | tcpdump | 4.9.3-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | tcpdump | 4.9.3-0ubuntu0.16.04.1 |
| ubuntu 18.04 | tcpdump | 4.9.3-0ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | tcpdump | 4.9.3-0ubuntu0.18.04.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2019-15167
- https://github.com/the-tcpdump-group/tcpdump/commit/a152aebfd1114376ba266ed30416be596ef9d806
- https://nvd.nist.gov/vuln/detail/CVE-2019-15167
- https://ubuntu.com/security/notices/USN-4252-1
- https://ubuntu.com/security/notices/USN-4252-2
- https://www.cve.org/CVERecord?id=CVE-2019-15167
- https://www.tcpdump.org/tcpdump-changes.txt