CVE catalog

CVE-2024-3024

tcpreplay: CVE-2024-3024

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Mar 28, 2024, 2:15:11 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.44% · Oct 25, 2026

A vulnerability was found in appneta tcpreplay up to 4.4.4. It has been classified as problematic. This affects the function get_layer4_v6 of the file /tcpreplay/src/common/get.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-258333 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	tcpreplay	sid	`4.5.4-1`	vulnerable
Debian	tcpreplay	forky	`4.5.4-1`	vulnerable
Debian	tcpreplay	trixie	`4.5.1-1`	vulnerable
Debian	tcpreplay	bookworm	`4.4.3-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	tcpreplay	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	tcpreplay	source	forky	`(unfixed)`	unimportant	Not reported	Not reported
Debian	tcpreplay	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	tcpreplay	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]