ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10968:03 advisory.

    * iputils: iputils integer overflow (CVE-2025-48964)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992151 advisory.

    ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or     incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to     large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
    this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp     calculations, and it did not account for a specific scenario where the original timestamp in the ICMP     payload is zero).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the iputils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or     incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to     large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
    this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp     calculations, and it did not account for a specific scenario where the original timestamp in the ICMP     payload is zero).(CVE-2025-48964)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization iputils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the iputils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ping in iputils before 20250602 allows a denial of service (application error or incorrect data     collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp     multiplication.(CVE-2025-47268)

    ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or     incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to     large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
    this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp     calculations, and it did not account for a specific scenario where the original timestamp in the ICMP     payload is zero).(CVE-2025-48964)

Tenable has extracted the preceding description block directly from the EulerOS iputils security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the iputils package has been released.

According to the versions of the iputils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or     incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to     large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
    this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp     calculations, and it did not account for a specific scenario where the original timestamp in the ICMP     payload is zero).(CVE-2025-48964)

Tenable has extracted the preceding description block directly from the EulerOS iputils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:17558 advisory.

    * iputils: iputils integer overflow (CVE-2025-48964)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:17558 advisory.

    * iputils: iputils integer overflow (CVE-2025-48964)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-17558 advisory.

    - Fix CVE-2025-48964 iputils: iputils integer overflow (RHEL-112001)
    - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping     (RHEL-94335)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17560 advisory.

    The iputils packages contain basic utilities for monitoring a network, including ping.

    Security Fix(es):

    * iputils: iputils integer overflow (CVE-2025-48964)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17558 advisory.

    The iputils packages contain basic utilities for monitoring a network, including ping.

    Security Fix(es):

    * iputils: iputils integer overflow (CVE-2025-48964)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17559 advisory.

    The iputils packages contain basic utilities for monitoring a network, including ping.

    Security Fix(es):

    * iputils: iputils integer overflow (CVE-2025-48964)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0652 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-48964:
    ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or     incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to     large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
    this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp     calculations, and it did not account for a specific scenario where the original timestamp in the ICMP     payload is zero).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or     incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to     large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
    this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp     calculations, and it did not account for a specific scenario where the original timestamp in the ICMP     payload is zero). (CVE-2025-48964)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-885e731f6f advisory.

    Update to 20250602 with fixes for CVE-2025-48964

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7670-1 advisory.

    It was discovered that the iputils ping utility incorrectly handled certain ICMP Echo Reply packets. A     remote attacker could possibly use this issue to cause iputils to consume resources, leading to a denial     of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-38be836506 advisory.

    Update to 20250602 with fixes for CVE-2025-48964

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02431-1 advisory.

    - CVE-2025-48964: Fixed integer overflow in ping statistics via zero timestamp (bsc#1243772).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:02432-1 advisory.

    - CVE-2025-48964: Fixed integer overflow in ping statistics via zero timestamp (bsc#1243772)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02430-1 advisory.

    - CVE-2025-48964: Fixed integer overflow in ping statistics via zero timestamp (bsc#1243772).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
282718	MiracleLinux 9 : iputils-20210202-11.el9_6.3 (AXSA:2025-10968:03)	Nessus	Miracle Linux Local Security Checks	medium
280086	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: iputils (UTSA-2025-992151)	Nessus	Unity Linux Local Security Checks	medium
279327	EulerOS Virtualization 2.13.1 : iputils (EulerOS-SA-2025-2545)	Nessus	Huawei Local Security Checks	medium
279312	EulerOS Virtualization 2.13.0 : iputils (EulerOS-SA-2025-2580)	Nessus	Huawei Local Security Checks	medium
274852	EulerOS 2.0 SP10 : iputils (EulerOS-SA-2025-2417)	Nessus	Huawei Local Security Checks	medium
274845	EulerOS 2.0 SP10 : iputils (EulerOS-SA-2025-2389)	Nessus	Huawei Local Security Checks	medium
272300	Photon OS 5.0: Iputils PHSA-2025-5.0-0668	Nessus	PhotonOS Local Security Checks	medium
271333	EulerOS 2.0 SP13 : iputils (EulerOS-SA-2025-2263)	Nessus	Huawei Local Security Checks	medium
271317	EulerOS 2.0 SP13 : iputils (EulerOS-SA-2025-2295)	Nessus	Huawei Local Security Checks	medium
270750	RockyLinux 9 : iputils (RLSA-2025:17558)	Nessus	Rocky Linux Local Security Checks	medium
270131	AlmaLinux 9 : iputils (ALSA-2025:17558)	Nessus	Alma Linux Local Security Checks	medium
270022	EulerOS 2.0 SP11 : iputils (EulerOS-SA-2025-2197)	Nessus	Huawei Local Security Checks	medium
270021	EulerOS 2.0 SP11 : iputils (EulerOS-SA-2025-2229)	Nessus	Huawei Local Security Checks	medium
269770	Oracle Linux 9 : iputils (ELSA-2025-17558)	Nessus	Oracle Linux Local Security Checks	medium
269748	RHEL 9 : iputils (RHSA-2025:17560)	Nessus	Red Hat Local Security Checks	medium
269744	RHEL 9 : iputils (RHSA-2025:17558)	Nessus	Red Hat Local Security Checks	medium
269717	RHEL 9 : iputils (RHSA-2025:17559)	Nessus	Red Hat Local Security Checks	medium
264450	EulerOS 2.0 SP12 : iputils (EulerOS-SA-2025-2042)	Nessus	Huawei Local Security Checks	medium
264401	EulerOS 2.0 SP12 : iputils (EulerOS-SA-2025-2011)	Nessus	Huawei Local Security Checks	medium
253489	TencentOS Server 4: iputils (TSSA-2025:0652)	Nessus	Tencent Local Security Checks	medium
249780	Linux Distros Unpatched Vulnerability : CVE-2025-48964	Nessus	Misc.	medium
244370	Fedora 41 : iputils (2025-885e731f6f)	Nessus	Fedora Local Security Checks	medium
242902	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : iputils vulnerability (USN-7670-1)	Nessus	Ubuntu Local Security Checks	medium
242882	Fedora 42 : iputils (2025-38be836506)	Nessus	Fedora Local Security Checks	medium
242521	SUSE SLES15 Security Update : iputils (SUSE-SU-2025:02431-1)	Nessus	SuSE Local Security Checks	medium
242517	SUSE SLES12 Security Update : iputils (SUSE-SU-2025:02432-1)	Nessus	SuSE Local Security Checks	medium
242501	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : iputils (SUSE-SU-2025:02430-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-48964

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium