Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-48964 EUVD-2025-22340

ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a cra…

Published Jul 22, 2025 · Updated Aug 26, 2025 · Assigned by mitre

Vendor: iputils Product: iputils Package: iprutils Package: iputils Package: iputils Package: iputils Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Ubuntu

Description

ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).

Affected products

VendorProductAffectedFixed
iputils iputils < 20250602 20250602

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 iputils 3:20240905-3ubuntu2 —
Ubuntu 24.04 LTS iputils 3:20240117-1ubuntu0.1 USN-7670-1
Ubuntu 22.04 LTS iputils 3:20211215-1ubuntu0.1 USN-7670-1
Ubuntu 20.04 LTS iputils No fix yet —
Ubuntu 18.04 LTS iputils No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS iputils No fix yet —
Ubuntu 14.04 LTS iputils No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 iputils 20240905-5.el10 RHSA-2026:18162
RHEL 9 iputils +1 20210202-11.el9_6.3 RHSA-2025:17558
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS iputils +1 20210202-9.el9_4.5 RHSA-2025:17560
RHEL 9.2 E4S iputils +1 20210202-8.el9_2.4 RHSA-2025:17559

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 iputils 20240905-5.el10 ALSA-2026:18162
AlmaLinux 9 iputils +1 20210202-11.el9_6.3 ALSA-2025:17558

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 iputils 20240905-5.el10 RLSA-2026:18162
Rocky Linux 9 iputils 20210202-11.el9_6.3 RLSA-2025:17558

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 iputils 20211215-150400.3.22.1 SUSE-SU-2025:02431-1, SUSE-SU-2025:02430-1
SLES 15 SP6 iputils 20211215-150400.3.22.1 SUSE-SU-2025:02431-1, SUSE-SU-2025:02430-1
SLES 12 SP5 iputils s20161105-11.12.1 SUSE-SU-2025:02432-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 iputils 20221126-slfo.1.1_2.1 SUSE-SU-2025:20442-1
SLE Micro 6.0 iputils 20221126-6.1 SUSE-SU-2025:20502-1
SLE Micro 5.5 iputils 20221126-150500.3.14.1 SUSE-SU-2025:02430-1
SLE Micro 5.4 iputils 20211215-150400.3.22.1 SUSE-SU-2025:02431-1
SLE Micro 5.3 iputils 20211215-150400.3.22.1 SUSE-SU-2025:02431-1
SLE Micro 5.2 iputils s20161105-150000.8.14.1 SUSE-SU-2025:02797-1
SLE Micro 5.1 iputils s20161105-150000.8.14.1 SUSE-SU-2025:02797-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 iputils 20221126-150500.3.14.1 SUSE-SU-2025:02430-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 iputils 20250602-r0 —
Alpine v3.23 iputils 20250602-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 iprutils No fix yet —
Azure Linux 3 iputils 20240117-2 —
Azure Linux 2 (CBL-Mariner) iputils 20211215-4 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 iputils 20240905-5.el10 ELSA-2026-18162
Oracle Linux 9 iputils +1 20210202-11.0.1.el9_6.3 ELSA-2025-17558

Advisories 18

References