inetutils - Debian Package Tracker

general

source: inetutils (main)
version: 2:2.7-3
maintainer: Guillem Jover (DMD)
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:2.0-1+deb11u2
o-o-sec: 2:2.0-1+deb11u3
oldstable: 2:2.4-2+deb12u1
old-sec: 2:2.4-2+deb12u2
old-p-u: 2:2.4-2+deb12u2
stable: 2:2.6-3+deb13u2
stable-sec: 2:2.6-3+deb13u2
testing: 2:2.7-3
unstable: 2:2.7-3

versioned links

2:2.0-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:2.0-1+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:2.4-2+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:2.4-2+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:2.6-3+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:2.7-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

inetutils-ftp
inetutils-ftpd
inetutils-inetd
inetutils-ping (2 bugs: 0, 0, 2, 0)
inetutils-syslogd (3 bugs: 0, 3, 0, 0)
inetutils-talk
inetutils-talkd (1 bugs: 0, 1, 0, 0)
inetutils-telnet (2 bugs: 0, 0, 2, 0)
inetutils-telnetd (1 bugs: 0, 0, 1, 0)
inetutils-tools
inetutils-traceroute
telnet
telnetd

action needed

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-32746: telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-32772: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

Created: 2026-03-14 Last update: 2026-03-14 17:33

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-32746: telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-32772: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

Created: 2026-03-14 Last update: 2026-03-14 17:33

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-32746: telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-32772: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

Created: 2026-03-14 Last update: 2026-03-14 17:33

3 security issues in bullseye high

There are 3 open security issues in bullseye.

2 important issues:

CVE-2026-32746: telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-32772: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

1 ignored issue:

CVE-2026-28372: telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

Created: 2026-03-14 Last update: 2026-03-14 17:33

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2026-32746: telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-32772: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

1 ignored issue:

CVE-2026-28372: telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

Created: 2026-02-16 Last update: 2026-03-14 17:33

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2026-03-15 23:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2:2.7-4, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit f264bcedc97f5e41190c89975dab15417fc3b4a3
Author: Guillem Jover <guillem@debian.org>
Date:   Fri Feb 27 13:11:17 2026 +0100

    Add references to CVE-2026-28372

commit b7b2a9bdb4a0a11e38b1665e20a481a191b47c79
Author: Guillem Jover <guillem@debian.org>
Date:   Sat Feb 21 02:20:38 2026 +0100

    Update patch metadata

Created: 2026-02-21 Last update: 2026-03-15 22:00

debian/patches: 7 patches to forward upstream low

Among the 9 debian patches available in version 2:2.7-3 of the package, we noticed the following issues:

7 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-02-16 23:33

news

[rss feed]

[2026-02-20] inetutils 2:2.7-3 MIGRATED to testing (Debian testing watch)
[2026-02-19] Accepted inetutils 2:2.6-3+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Guillem Jover)
[2026-02-19] Accepted inetutils 2:2.6-3+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Guillem Jover)
[2026-02-16] Accepted inetutils 2:2.7-3 (source) into unstable (Guillem Jover)
[2026-01-24] Accepted inetutils 2:2.0-1+deb11u3 (source) into oldoldstable-security (Andreas Henriksson)
[2026-01-24] Accepted inetutils 2:2.4-2+deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Guillem Jover)
[2026-01-24] Accepted inetutils 2:2.6-3+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Guillem Jover)
[2026-01-24] inetutils 2:2.7-2 MIGRATED to testing (Debian testing watch)
[2026-01-22] Accepted inetutils 2:2.4-2+deb12u2 (source) into oldstable-security (Debian FTP Masters) (signed by: Guillem Jover)
[2026-01-22] Accepted inetutils 2:2.6-3+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Guillem Jover)
[2026-01-20] Accepted inetutils 2:2.7-2 (source) into unstable (Guillem Jover)
[2025-12-19] inetutils 2:2.7-1 MIGRATED to testing (Debian testing watch)
[2025-12-17] Accepted inetutils 2:2.7-1 (source) into unstable (Guillem Jover)
[2025-08-16] inetutils 2:2.6-4 MIGRATED to testing (Debian testing watch)
[2025-08-10] Accepted inetutils 2:2.6-4 (source) into unstable (Guillem Jover)
[2025-07-04] inetutils 2:2.6-3 MIGRATED to testing (Debian testing watch)
[2025-06-22] Accepted inetutils 2:2.6-3 (source) into unstable (Guillem Jover)
[2025-06-20] Accepted inetutils 2:2.6-2 (source) into unstable (Guillem Jover)
[2025-02-25] inetutils 2:2.6-1 MIGRATED to testing (Debian testing watch)
[2025-02-22] Accepted inetutils 2:2.6-1 (source) into unstable (Guillem Jover)
[2025-02-20] inetutils 2:2.5-6 MIGRATED to testing (Debian testing watch)
[2025-02-18] Accepted inetutils 2:2.5-6 (source) into unstable (Guillem Jover)
[2024-06-26] inetutils 2:2.5-5 MIGRATED to testing (Debian testing watch)
[2024-06-23] Accepted inetutils 2:2.5-5 (source) into unstable (Guillem Jover)
[2024-05-09] inetutils 2:2.5-4 MIGRATED to testing (Debian testing watch)
[2024-05-02] Accepted inetutils 2:2.5-4 (source) into unstable (Guillem Jover)
[2024-01-18] inetutils 2:2.5-3 MIGRATED to testing (Debian testing watch)
[2024-01-16] Accepted inetutils 2:2.5-3 (source) into unstable (Guillem Jover)
[2024-01-07] Accepted inetutils 2:2.5-2 (source) into experimental (Guillem Jover)
[2024-01-01] inetutils 2:2.5-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 15
RC: 1
I&N: 5
M&W: 9
F&P: 0
patch: 2

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:2.7-2ubuntu1
13 bugs
patches for 2:2.7-2ubuntu1