Latest gnu inetutils Vulnerabilities

● CVE-2023-40303

GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if th...

ubuntu/inetutils<2:1.9.4-11ubuntu0.2

ubuntu/inetutils<2:2.2-2ubuntu0.1

ubuntu/inetutils<2:2.4-2ubuntu1.1

<=2.4

GNU inetutils<=2.4

debian/inetutils<=2:1.9.4-7+deb10u1<=2:1.9.4-7+deb10u2<=2:2.0-1+deb11u1<=2:2.4-2

● CVE-2022-39028

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application wo...

debian/inetutils<=2:1.9.4-7+deb10u1

ubuntu/inetutils<2:1.9.4-11ubuntu0.2

ubuntu/inetutils<2:2.2-2ubuntu0.1

ubuntu/inetutils<2:2.3-5

GNU inetutils<=2.3

MIT Kerberos 5<=1.0.3

and 2 more

● CVE-2021-40491

The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

debian/inetutils<=2:2.0-1<=2:1.9.4-7<=2:1.9.4-7+deb10u1

GNU inetutils<2.2

Debian Debian Linux=10.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.