CVE-2026-28372

概要

参考情報

• git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit · Patch
• lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html · Exploit
• lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.html · Mailing List
• openwall.com/lists/oss-security/2026/02/24/1 · Mailing List
• openwall.com/lists/oss-security/2026/02/27/3 · Mailing List
• openwall.com/lists/oss-security/2026/03/06/2
• openwall.com/lists/oss-security/2026/03/06/3
• openwall.com/lists/oss-security/2026/03/07/1
• openwall.com/lists/oss-security/2026/03/07/2

inetutils のその他の脆弱性

• CVE-2026-32772中 4.7telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
• CVE-2026-32746緊急 9.8telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_…
• CVE-2026-24061緊急 9.8悪用確認済み（CISA KEV）telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
• CVE-2023-40303高 7.8GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin…
• CVE-2022-39028高 7.5telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff…