CVE-2026-28372

Mô tả

Tham khảo

• git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit · Patch
• lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html · Exploit
• lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.html · Mailing List
• openwall.com/lists/oss-security/2026/02/24/1 · Mailing List
• openwall.com/lists/oss-security/2026/02/27/3 · Mailing List
• openwall.com/lists/oss-security/2026/03/06/2
• openwall.com/lists/oss-security/2026/03/06/3
• openwall.com/lists/oss-security/2026/03/07/1
• openwall.com/lists/oss-security/2026/03/07/2

Lỗ hổng khác của inetutils

• CVE-2026-32772TRUNG BÌNH 4.7telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
• CVE-2026-32746NGHIÊM TRỌNG 9.8telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_…
• CVE-2026-24061NGHIÊM TRỌNG 9.8ĐANG BỊ KHAI THÁC (CISA KEV)telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
• CVE-2023-40303CAO 7.8GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin…
• CVE-2022-39028CAO 7.5telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff…