CVE catalog
CVE-2023-40303
inetutils: CVE-2023-40303
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.41% · Oct 25, 2026
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | inetutils | sid | 2:2.8-4 | fixed |
| Debian | inetutils | forky | 2:2.8-4 | fixed |
| Debian | inetutils | trixie | 2:2.6-3+deb13u3 | fixed |
| Debian | inetutils | trixie-security | 2:2.6-3+deb13u3 | fixed |
| Debian | inetutils | bookworm | 2:2.4-2+deb12u3 | fixed |
| Debian | inetutils | bookworm-security | 2:2.4-2+deb12u3 | fixed |
| Ubuntu | inetutils | pro | 2:1.9.4-2build1 | vulnerable |
| Ubuntu | inetutils | pro | 2:1.9.4-3 | vulnerable |
| Ubuntu | inetutils | pro | 2:1.9.4-3ubuntu0.1 | vulnerable |
| Ubuntu | inetutils | pro | 2:1.9.4-3ubuntu0.1+esm1 | vulnerable |
| Ubuntu | inetutils | pro | 2:1.9.4-3ubuntu0.1+esm2 | fixed |
| Ubuntu | inetutils | 20.04 | 2:1.9.4-10build1 | vulnerable |
| Ubuntu | inetutils | 20.04 | 2:1.9.4-11 | vulnerable |
| Ubuntu | inetutils | 20.04 | 2:1.9.4-11ubuntu0.1 | vulnerable |
| Ubuntu | inetutils | 20.04 | 2:1.9.4-11ubuntu0.2 | fixed |
| Ubuntu | inetutils | 22.04 | 2:2.0-1 | vulnerable |
| Ubuntu | inetutils | 22.04 | 2:2.2-2 | vulnerable |
| Ubuntu | inetutils | 22.04 | 2:2.2-2ubuntu0.1 | fixed |
| Ubuntu | inetutils | 24.04 | 2:2.4-2ubuntu2 | vulnerable |
| Ubuntu | inetutils | 24.04 | 2:2.4-3ubuntu1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | inetutils | source | sid | 2:2.4-3 | not yet assigned | Not reported | [1049365] |
| Debian | inetutils | source | forky | 2:2.4-3 | not yet assigned | Not reported | [1049365] |
| Debian | inetutils | source | trixie | 2:2.4-3 | not yet assigned | Not reported | [1049365] |
| Debian | inetutils | source | bookworm | 2:2.4-2+deb12u1 | not yet assigned | Not reported | [1049365] |
| Ubuntu | inetutils | deb | pro | 2:1.9.4-3ubuntu0.1+esm2 | Not reported | UBUNTU-CVE-2023-40303 | Not reported |
| Ubuntu | inetutils | deb | 20.04 | 2:1.9.4-11ubuntu0.2 | Not reported | UBUNTU-CVE-2023-40303 | Not reported |
| Ubuntu | inetutils | deb | 22.04 | 2:2.2-2ubuntu0.1 | Not reported | UBUNTU-CVE-2023-40303 | Not reported |
| Ubuntu | inetutils | deb | 24.04 | 2:2.4-3ubuntu1 | Not reported | UBUNTU-CVE-2023-40303 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.