Summary
Matthew Hickey discovered that Inetutils did not correctly handle certain
escape characters. An attacker could possibly use this issue to cause a
denial of service. (CVE-2019-0053)
It was discovered that Inetutils did not correctly handle certain memory
operations. An attacker could possibly use this issue to execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-10188)
It was discovered that Inetutils did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2022-39028)
It was discovered that Inetutils did not check the return values of set*id
functions. An attacker could possibly use this issue to escalate their
privileges. (CVE-2023-40303)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | inetutils | 2:1.9.2-1ubuntu0.1~esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | inetutils | 2:1.9.4-1ubuntu0.1~esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | inetutils | 2:1.9.4-3ubuntu0.1+esm2 |
Vulnerabilities 4
-
High 7.8CVE-2019-0053 Public exploit
Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of envir…
-
Unscored —CVE-2020-10188 EPSS 74%
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes o…
-
Unscored —
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference …
-
Unscored —
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions…