Integer overflow in iputils - CVE-2025-48964

Vulnerability identifier: #VU114680

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-48964

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in ping. A remote attacker can send a specially crafted ICMP Echo Reply packet to trigger an integer overflow and crash the application.

iputils
Storage Virtualize
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
AppDynamics NodeJS Agent
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
openEuler
Ubuntu
Anolis OS
Fedora
LANTIME Operating System Firmware (LTOS)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
iputils-debugsource
iputils
iputils-debuginfo
iputils (Red Hat package)
iputils (Ubuntu package)
iputils-help
Juniper Junos Space

Install updates from vendor's website.

iputils - update to 20250602
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
LANTIME Operating System Firmware (LTOS) - update to 7.08.025
Storage Virtualize - addressed in versions 8.7.0.8, 9.1.0.2
AppDynamics NodeJS Agent - update to 25.12.1
iputils-debugsource - update to s20161105-150000.8.14.1
iputils - update to s20161105-150000.8.14.1
iputils-debuginfo - update to s20161105-150000.8.14.1
Juniper Junos Space - update to 26.1R1 Patch V1
iputils (Red Hat package) - addressed in versions 20210202-8.el9_2.4, 20210202-9.el9_4.5, 20210202-11.el9_6.3
iputils (Ubuntu package) - addressed in versions 3:20211215-1ubuntu0.1, 3:20240117-1ubuntu0.1, 3:20240905-1ubuntu1.1
iputils - update to 20221126-3
iputils-debuginfo - update to 20221126-8
iputils-help - update to 20221126-8
iputils-debugsource - update to 20221126-8
iputils - update to 20221126-8
iputils - addressed in versions 20250602-3.fc41, 20250602-3.fc42

• https://bugzilla.suse.com/show_bug.cgi?id=1243772
• https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c
• https://github.com/iputils/iputils/issues
• https://github.com/iputils/iputils/releases/tag/20250602
• https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9

• Remote denial of service in iputils ping
• Fedora 41 update for iputils
• Fedora 42 update for iputils
• SUSE update for iputils
• Anolis OS update for iputils
• Multiple vulnerabilities in Meinberg LANTIME firmware
• Ubuntu update for iputils
• openEuler 22.03 LTS SP4 update for iputils
• openEuler 22.03 LTS SP3 update for iputils
• openEuler 24.03 LTS SP2 update for iputils
• openEuler 24.03 LTS SP1 update for iputils
• openEuler 24.03 LTS update for iputils
• Red Hat Enterprise Linux 9 update for iputils
• Red Hat Enterprise Linux 9 update for iputils
• Red Hat Enterprise Linux 9 update for iputils
• Multiple vulnerabilities in IBM Storage Virtualize
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Splunk AppDynamics NodeJS Agent update for third-party components
• Multiple vulnerabilities in Junos Space