CVE-2007-1218

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-03-02 · updated 2026-06-16
Weakness: CWE-119

Description

Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.

Affected products

The Tcpdump Group tcpdump: through 3.9.5

References

http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c
http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c?r1=1.31.2.11&r2=1.31.2.12
http://docs.info.apple.com/article.html?artnum=307179
http://fedoranews.org/cms/node/2798
http://fedoranews.org/cms/node/2799
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://seclists.org/fulldisclosure/2007/Mar/0003.html
http://secunia.com/advisories/24318
http://secunia.com/advisories/24354
http://secunia.com/advisories/24423
http://secunia.com/advisories/24451
http://secunia.com/advisories/24583

Get alerted when CVE-2007-1218 or the next vulnerability affects your stack