« Volver al listado

CVE-2025-48964

Estado: AplazadaMedia (6.5)—

ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Iputils — IputilsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-48964",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48964",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-22T18:00:42.570227Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "iputils",
          "product": "iputils",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "20250602",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-22T18:15:36.020",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1243772",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/iputils/iputils/issues",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/iputils/iputils/releases/tag/20250602",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero)."
    },
    {
      "lang": "es",
      "value": "El ping en iputils hasta la versión 20240905 permite una denegación de servicio (error de aplicación en modo ping adaptativo o recopilación incorrecta de datos) mediante un paquete de respuesta de eco ICMP manipulado, ya que una marca de tiempo cero puede generar valores intermedios grandes que presentan un desbordamiento de enteros al elevarlos al cuadrado durante los cálculos estadísticos. NOTA: Este problema existe debido a una corrección incompleta para CVE-2025-47268 (dicha corrección solo afectaba a los cálculos de marca de tiempo y no contemplaba un escenario específico donde la marca de tiempo original en la payload ICMP es cero)."
    }
  ],
  "lastModified": "2026-06-17T09:30:35.243",
  "sourceIdentifier": "cve@mitre.org"
}