The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfs_printfh().
{ "vanir_signatures": [ { "id": "CVE-2017-13001-4e8d8618", "digest": { "length": 968.0, "function_hash": "230688506456139063272701511816479227468" }, "signature_version": "v1", "target": { "file": "print-nfs.c", "function": "nfs_printfh" }, "deprecated": false, "signature_type": "Function", "source": "https://github.com/the-tcpdump-group/tcpdump/commit/7a923447fd49a069a0fd3b6c3547438ab5ee2123" }, { "id": "CVE-2017-13001-9ff17b19", "digest": { "line_hashes": [ "5857539386754636615602856101539394027", "14555024741917073240752010681359981813", "18744574178876283298956859420291716746", "187965339838020869824004327674875503156", "114722929830447744645645576552211935618", "306332199128179485669170971416640858789" ], "threshold": 0.9 }, "signature_version": "v1", "target": { "file": "print-nfs.c" }, "deprecated": false, "signature_type": "Line", "source": "https://github.com/the-tcpdump-group/tcpdump/commit/7a923447fd49a069a0fd3b6c3547438ab5ee2123" } ] }