Moderate Security Vulnerability in iputils: Signed Integer Overflow in Timestamp Multiplication
Summary
ALSA-2025:9421: Moderate: iputils security update. Affects iputils versions < 20240905-2.el10_0.1. Fixed in 20240905-2.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The iputils package provides essential utilities for network monitoring, including the widely used 'ping' command. It is a critical tool for diagnosing network connectivity issues and assessing the reachability of hosts on an IP network. However, the iputils package has been found to contain a vulnerability that could potentially compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-47268 is a signed integer overflow that occurs during timestamp multiplication in the iputils ping utility. This flaw can lead to unexpected behavior, including potential denial of service or arbitrary code execution, depending on how the overflow is exploited. The issue arises from improper handling of integer values, which can be manipulated by an attacker to cause the application to behave unpredictably.
How To Fix
Minimum fixed version
20240905-2.el10_0.1
This is the first release that contains the fix.
sudo dnf update iputilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the ping utility until the package is updated. Additionally, consider using alternative tools for network monitoring that do not rely on iputils.
Conclusion
The iputils package has a moderate security vulnerability that needs to be addressed promptly. By updating to the latest patched version, users can protect their systems from potential exploits associated with CVE-2025-47268. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for iputils →
FAQ
CVE-2025-47268 is a security vulnerability in the iputils package that involves a signed integer overflow in the timestamp multiplication process.
This vulnerability can lead to unexpected behavior in the iputils ping utility, potentially allowing attackers to disrupt network services or execute arbitrary code.
You can check if your application is affected by this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
Update the iputils package to the patched version 20240905-2.el10_0.1 using the command 'sudo dnf update iputils'.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for iputils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
