CVE-2025-48964
ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer…
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Source
- cve@mitre.org
References
- https://bugzilla.suse.com/show_bug.cgi?id=1243772
- https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c
- https://github.com/iputils/iputils/issues
- https://github.com/iputils/iputils/releases/tag/20250602
- https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.