rpm package
suse/ntp&distro=SUSE Linux Enterprise Server for SAP Applications 12
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012
Vulnerabilities (64)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2015-7851 | — | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Jan 28, 2020 | Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files. | ||
| CVE-2016-9042 | — | < 4.2.8p10-46.23.1 | 4.2.8p10-46.23.1 | Jun 4, 2018 | An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will f | ||
| CVE-2015-3405 | Hig | 7.5 | < 4.2.6p5-44.1 | 4.2.6p5-44.1 | Aug 9, 2017 | ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the valu | |
| CVE-2015-7871 | Cri | 9.8 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. | |
| CVE-2015-7855 | Med | 6.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value. | |
| CVE-2015-7854 | Hig | 8.8 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file. | |
| CVE-2015-7853 | Cri | 9.8 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value. | |
| CVE-2015-7852 | Med | 5.9 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets. | |
| CVE-2015-7850 | Med | 6.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file. | |
| CVE-2015-7849 | Hig | 8.8 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets. | |
| CVE-2015-7705 | Cri | 9.8 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests. | |
| CVE-2015-7704 | Hig | 7.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. | |
| CVE-2015-7702 | Med | 6.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. | |
| CVE-2015-7701 | Hig | 7.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption). | |
| CVE-2015-7692 | Hig | 7.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750. | |
| CVE-2015-7691 | Hig | 7.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Aug 7, 2017 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014- | |
| CVE-2015-7703 | Hig | 7.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Jul 24, 2017 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote co | |
| CVE-2015-5300 | Hig | 7.5 | < 4.2.8p6-46.5.2 | 4.2.8p6-46.5.2 | Jul 21, 2017 | The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to | |
| CVE-2015-5219 | Hig | 7.5 | < 4.2.8p9-46.18.1 | 4.2.8p9-46.18.1 | Jul 21, 2017 | The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet. | |
| CVE-2017-6464 | Med | 6.5 | < 4.2.8p10-46.23.1 | 4.2.8p10-46.23.1 | Mar 27, 2017 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive. |
- CVE-2015-7851Jan 28, 2020affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.
- CVE-2016-9042Jun 4, 2018affected < 4.2.8p10-46.23.1fixed 4.2.8p10-46.23.1
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will f
- affected < 4.2.6p5-44.1fixed 4.2.6p5-44.1
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the valu
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote co
- affected < 4.2.8p6-46.5.2fixed 4.2.8p6-46.5.2
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to
- affected < 4.2.8p9-46.18.1fixed 4.2.8p9-46.18.1
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
- affected < 4.2.8p10-46.23.1fixed 4.2.8p10-46.23.1
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.
Page 1 of 4