ppp decapsulator can be convinced to allocate a large amount of memory

Description

The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

Scores

EPSS (exploitation in 30 days)

3.1% · top 12% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• memory overallocation error
• CWE-770 (opens in a new tab)All about CWE-770 and its CVEs

Affected products

• The TCPdump Group · tcpdump

  • affected 4.9.3

References (8)

• https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231 (opens in a new tab)x_refsource_MISCx_transferred
• [debian-lts-announce] 20201110 [SECURITY] [DLA 2444-1] tcpdump security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• FEDORA-2020-fae2e1f2bc (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• FEDORA-2020-c5e78886d6 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 20210427 APPLE-SA-2021-04-26-3 Security Update 2021-002 Catalina (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• https://support.apple.com/kb/HT212325 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.apple.com/kb/HT212326 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.apple.com/kb/HT212327 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-8037](https://trackcve.app/badge/CVE-2020-8037.svg)](https://trackcve.app/cve/CVE-2020-8037)

Record last updated 16 Sept 2024, 20:27 UTC.