The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().
{ "vanir_signatures": [ { "target": { "file": "print-ppp.c", "function": "handle_mlppp" }, "signature_version": "v1", "id": "CVE-2017-13038-644b08e3", "digest": { "length": 309.0, "function_hash": "104475510614543381647945374694756825848" }, "deprecated": false, "source": "https://github.com/the-tcpdump-group/tcpdump/commit/7335163a6ef82d46ff18f3e6099a157747241629", "signature_type": "Function" }, { "target": { "file": "print-ppp.c" }, "signature_version": "v1", "id": "CVE-2017-13038-ce0f6166", "digest": { "threshold": 0.9, "line_hashes": [ "207321312831272802920847581388257873641", "113784297248733078625081073952188932860", "125372704519316314067301538403105121868" ] }, "deprecated": false, "source": "https://github.com/the-tcpdump-group/tcpdump/commit/7335163a6ef82d46ff18f3e6099a157747241629", "signature_type": "Line" } ] }