UbuntuUpdates.org

Package "inetutils-tools"

Name: inetutils-tools

Description:

base networking utilities (experimental package)
Latest version: 2:2.2-2ubuntu0.2
Release: jammy (22.04)
Level: updates
Repository: universe
Head package: inetutils
Homepage: https://www.gnu.org/software/inetutils/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "inetutils-tools"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "inetutils-tools" in Jammy

Repository Area Version
base universe 2:2.2-2
security universe 2:2.2-2ubuntu0.2

Changelog

Version: 2:2.2-2ubuntu0.2 2026-02-02 20:08:15 UTC

  inetutils (2:2.2-2ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: telnetd remote authentication bypass
    - debian/patches/CVE-2026-24061-1.patch: fix injection bug with bogus
      user names in telnetd/utility.c.
    - debian/patches/CVE-2026-24061-2.patch: sanitize all variable
      expansions in telnetd/utility.c.
    - debian/patches/CVE-2026-24061-3.patch: fix compiler warning in
      telnetd/utility.c.
    - CVE-2026-24061

 -- Marc Deslauriers <email address hidden> Fri, 30 Jan 2026 11:18:47 -0500
Source diff to previous version
CVE-2026-24061 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Version: 2:2.2-2ubuntu0.1 2023-08-22 19:06:59 UTC

  inetutils (2:2.2-2ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL dereference DoS
    - debian/patches/CVE-2022-39028.patch: fix remote DoS
      in inetutils-telnetd in telnetd/state.c.
    - CVE-2022-39028
  * SECURITY UPDATE: Privilege escalation
    - debian/patches/CVE-2023-40303.patch: check setuid, setguid return values
      in ftpd/ftpd.c, src/rpc.c, src/rlogin.c, src/rsh.c, src/rshd.c,
      src/uucpd.c.
    - CVE-2023-40303

 -- Leonidas Da Silva Barbosa <email address hidden> Tue, 15 Aug 2023 10:13:06 -0300
CVE-2022-39028 telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In
CVE-2023-40303 GNU inetutils through 2.4 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, r


About   -   Send Feedback to @ubuntu_updates