What’s Vulnerable › Vulnerabilities

CVE-2020-8037: ppp decapsulator can be convinced to allocate a large amount of memory

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-04 · updated 2026-06-17
Weakness: CWE-770

Description

The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

Affected products

macOS: before 10.14.6; from 10.15 before 10.15.7; 10.14.6, 10.14.6-security_update_2019-001, 10.14.6-security_update_2019-002, 10.14.6-security_update_2020-001, 10.14.6-security_update_2020-002, 10.14.6-security_update_2020-003 (+9) — fixed in 10.14.6, 10.15.7
Apple macOS: from 11.0 before 11.3 — fixed in 11.3
Debian Linux: 9.0
Fedoraproject Fedora: 32, 33
The Tcpdump Group tcpdump: 4.9.3

How to fix

Upgrade to a fixed version: macOS 10.14.6, 10.15.7; Apple macOS 11.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8037 or the next vulnerability affects your stack