Gnu Inetutils
9 CVEs affecting Gnu Inetutils. Latest disclosed: 2026-03-16. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32746 | Critical | 9.8 | 2026-03-13 | telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check… |
CVE-2026-24061 | Critical | 9.8 | 2026-01-21 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
CVE-2023-40303 | High | 7.8 | 2023-08-14 | GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uu… |
CVE-2022-39028 | High | 7.5 | 2022-08-30 | telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical… |
CVE-2026-28372 | High | 7.4 | 2026-02-27 | telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) imp… |
CVE-2021-40491 | Medium | 6.5 | 2021-09-03 | The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is simi… |
CVE-2026-32772 | Low | 3.4 | 2026-03-16 | telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR. |
CVE-2011-4862 | | 2011-12-25 | Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1… | |
CVE-2004-1485 | | 2004-12-31 | Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by… |