CVE-2018-17974

Name	CVE-2018-17974
Description	An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer over-read was triggered in the function dlt_en10mb_encode() of the file plugins/dlt_en10mb/en10mb.c, due to inappropriate values in the function memmove(). The length (pktlen + ctx -> l2len) can be larger than source value (packet + ctx->l2len) because the function fails to ensure the length of a packet is valid. This leads to Denial of Service.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	910598

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tcpreplay (PTS)	jessie	3.4.4-2+deb8u1	vulnerable
	stretch	3.4.4-3	vulnerable
	buster	4.3.1-1	fixed
	bullseye	4.3.3-2	fixed
	bookworm	4.4.3-1	fixed
	sid, trixie	4.5.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
tcpreplay	source	wheezy	(unfixed)	end-of-life
tcpreplay	source	(unstable)	4.3.1-1			910598

[stretch] - tcpreplay <no-dsa> (Minor issue)
[jessie] - tcpreplay <no-dsa> (Minor issue)
https://github.com/appneta/tcpreplay/issues/486