CVE-2007-1218

CVE-2007-1218 is a medium-severity vulnerability in Tcpdump with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.8)
• EPSS exploit prediction: 3% (85th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Tcpdump
• Published: 2007-03-02
• Last modified: 2026-06-16

Description

Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.

Frequently asked questions

What is CVE-2007-1218?

Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.

How severe is CVE-2007-1218?

CVE-2007-1218 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2007-1218 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-1218?

CVE-2007-1218 affects Tcpdump. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-1218?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-1218 published?

CVE-2007-1218 was published on 2007-03-02 and last updated on 2026-06-16.

References

• http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c
• http://cvs.tcpdump.org/cgi-bin/cvsweb/tcpdump/print-802_11.c?r1=1.31.2.11&r2=1.31.2.12
• http://docs.info.apple.com/article.html?artnum=307179
• http://fedoranews.org/cms/node/2798
• http://fedoranews.org/cms/node/2799
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
• http://seclists.org/fulldisclosure/2007/Mar/0003.html
• http://secunia.com/advisories/24318
• http://secunia.com/advisories/24354
• http://secunia.com/advisories/24423
• http://secunia.com/advisories/24451
• http://secunia.com/advisories/24583
• http://secunia.com/advisories/24610
• http://secunia.com/advisories/27580
• http://secunia.com/advisories/28136
• http://www.debian.org/security/2007/dsa-1272
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:056
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:155
• http://www.osvdb.org/32427
• http://www.redhat.com/support/errata/RHSA-2007-0368.html
• http://www.redhat.com/support/errata/RHSA-2007-0387.html
• http://www.securityfocus.com/bid/22772
• http://www.securitytracker.com/id?1017717
• http://www.turbolinux.com/security/2007/TLSA-2007-46.txt
• http://www.ubuntu.com/usn/usn-429-1
• http://www.us-cert.gov/cas/techalerts/TA07-352A.html
• http://www.vupen.com/english/advisories/2007/0793
• http://www.vupen.com/english/advisories/2007/4238
• https://bugs.gentoo.org/show_bug.cgi?id=168916
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32749

Affected products (1)

• cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*

More vulnerabilities in Tcpdump

• CVE-2018-10105 — Critical (CVSS 9.8): tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).
• CVE-2018-10103 — Critical (CVSS 9.8): tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).
• CVE-2017-13725 — Critical (CVSS 9.8): The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print().
• CVE-2017-13690 — Critical (CVSS 9.8): The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.
• CVE-2017-13689 — Critical (CVSS 9.8): The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print().
• CVE-2017-13688 — Critical (CVSS 9.8): The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().

All CVEs affecting Tcpdump →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →