CveMateVulnerability intelligence

Broadcom Tcpreplay vulnerabilities

50 vulnerabilities

Known vulnerabilities in Broadcom Tcpreplay, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2018-13112broadcomtcpreplay+28y ago03-07-2018 17:00

get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packets, as demonstrated by tcpprep.CVE-2018-20553broadcomtcpreplay+27y ago28-12-2018 13:00

Tcpreplay before 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c.CVE-2018-20552broadcomtcpreplay+27y ago28-12-2018 13:00

Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c.CVE-2018-17974broadcomtcpreplay+28y ago03-10-2018 22:00

An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer over-read was triggered in the function dlt_en10mb_encode() of the file plugins/dlt_en10mb/en10mb.c, due to inappropriate values in the function memmove(). The length (pktlen + ctx -> l2len) can be larger than source value (packet + ctx->l2len) because the function fails to ensure the length of a packet is valid. This leads to Denial of Service.CVE-2018-17582broadcomtcpreplay+28y ago28-09-2018 09:00

Tcpreplay v4.3.0 beta1 contains a heap-based buffer over-read. The get_next_packet() function in the send_packets.c file uses the memcpy() function unsafely to copy sequences from the source buffer pktdata to the destination (*prev_packet)->pktdata. This will result in a Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a file.CVE-2018-17580broadcomtcpreplay+28y ago28-09-2018 09:00

A heap-based buffer over-read exists in the function fast_edit_packet() in the file send_packets.c of Tcpreplay v4.3.0 beta1. This can lead to Denial of Service (DoS) and potentially Information Exposure when the application attempts to process a crafted pcap file.CVE-2018-18408broadcomtcpreplay+38y ago17-10-2018 04:00

A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c, causing a denial of service or possibly unspecified other impact.CVE-2018-18407broadcomtcpreplay+38y ago17-10-2018 04:00

A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.CVE-2021-45387broadcomtcpreplay+14y ago11-02-2022 00:00

tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.CVE-2021-45386broadcomtcpreplay+14y ago11-02-2022 00:00

tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c CVE-2016-6160broadcomtcpreplay+49y ago23-01-2017 21:00

tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related issue to CVE-2017-14266.CVE-2025-51005broadcomtcpreplay+21y ago23-09-2025 00:00

A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1. When a crafted pcap file is processed, the program incorrectly handles memory in the checksum calculation logic at do_checksum_math_liveplay in tcpliveplay.c, leading to a possible denial of service.CVE-2025-51006broadcomtcpreplay+21y ago22-09-2025 00:00

Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c. This vulnerability is triggered when tcpedit_dlt_cleanup() indirectly invokes the cleanup routine multiple times on the same memory region. By supplying a specifically crafted pcap file to the tcprewrite binary, a local attacker can exploit this flaw to cause a Denial of Service (DoS) via memory corruption.CVE-2025-9385appnetatcpreplay+31y ago24-08-2025 10:32

A flaw has been found in appneta tcpreplay up to 4.5.1. The affected element is the function fix_ipv6_checksums of the file edit_packet.c of the component tcprewrite. This manipulation causes use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version 4.5.2-beta3 is sufficient to fix this issue. It is advisable to upgrade the affected component.CVE-2025-9386appnetatcpreplay+31y ago24-08-2025 11:02

A vulnerability has been found in appneta tcpreplay up to 4.5.1. The impacted element is the function get_l2len_protocol of the file get.c of the component tcprewrite. Such manipulation leads to use after free. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.2-beta3 is sufficient to resolve this issue. You should upgrade the affected component.CVE-2025-9384appnetatcpreplay+31y ago24-08-2025 10:02

A vulnerability was detected in appneta tcpreplay up to 4.5.1. Impacted is the function tcpedit_post_args of the file /src/tcpedit/parse_args.c. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 4.5.2-beta2 is recommended to address this issue. Upgrading the affected component is advised. The vendor explains, that he was "[a]ble to reproduce in 6fcbf03 but not in 4.5.2-beta2".CVE-2025-9019broadcomtcpreplay+21y ago15-08-2025 07:02

A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The researcher is able to reproduce this with the latest official release 4.5.1 and the current master branch. The code maintainer cannot reproduce this for 4.5.2-beta1. In his reply the maintainer explains that "[i]n that case, this is a duplicate that was fixed in 4.5.2."CVE-2025-9649appnetatcpreplay+31y ago29-08-2025 13:32

A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3."CVE-2020-18976broadcomtcpreplay+25y ago25-08-2021 15:54

Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do_checksum' function in 'checksum.c'. It can be triggered by sending a crafted pcap file to the 'tcpreplay-edit' binary. This issue is different than CVE-2019-8381.CVE-2020-24266broadcomtcpreplay+36y ago19-10-2020 14:58

An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap buffer overflow vulnerability in get_l2len() that can make tcpprep crash and cause a denial of service.