{"id":"CVE-2015-5195","aliases":["DEBIAN-CVE-2015-5195","DLA-335-1","DSA-3388-1","EUVD-2015-5196","GHSA-rr6m-2g2v-4vm5","MGASA-2015-0348","RHSA-2016:0780","RHSA-2016:2583","UBUNTU-CVE-2015-5195","USN-2783-1"],"status":"published","title":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of...","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08753,"percentile":0.95193,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2015-08-25T00:00:00Z","modified":"2026-08-27T23:01:02Z","exploits":[{"source":"pocgithub","id":"theglife214/CVE-2015-5195","title":"theglife214/CVE-2015-5195","date":"2017-03-04","url":"https://github.com/theglife214/CVE-2015-5195"}],"fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p2+dfsg-1+deb6u4"}]}],"versions":["1:4.2.6.p2+dfsg-1"],"bundled":16},{"source":"osv","ecosystem":"Debian:7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-2+deb7u6"}]}],"versions":["1:4.2.6.p5+dfsg-2","1:4.2.6.p5+dfsg-2+deb7u1","1:4.2.6.p5+dfsg-2+deb7u2","1:4.2.6.p5+dfsg-2+deb7u3","1:4.2.6.p5+dfsg-2+deb7u4","1:4.2.6.p5+dfsg-2+deb7u5"],"bundled":16},{"source":"osv","ecosystem":"Debian:8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-7+deb8u1"}]}],"versions":["1:4.2.6.p5+dfsg-7"],"bundled":16},{"source":"osv","ecosystem":"Mageia:4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-15.6.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-24.1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"],"bundled":18}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"ntp","product":"ntp"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1254544","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=isg3T1024157","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/ntp-project/ntp/commit/52e977d79a0c4ace997e5c74af429844da2f27be","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.ubuntu.com/usn/USN-2783-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21986956","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21988706","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2583.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0780.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3388","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/08/25/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix","report"]},{"url":"http://www.securityfocus.com/bid/76474","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21989542","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21985122","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5195","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0780","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2583","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5195","tags":["report"]},{"url":"https://github.com/advisories/GHSA-rr6m-2g2v-4vm5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5195","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0348.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16322","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2015/08/25/3","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Release_Notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Technical_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1254542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1254547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1255118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1274254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1274255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1274261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1286969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300270","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0780.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5194","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5194","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5195","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5219","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5219","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7691","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner","tags":["article"]},{"url":"https://github.com/ntp-project/ntp/blob/stable/NEWS#L11","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7701","tags":["advisory"]},{"url":"https://github.com/ntp-project/ntp/blob/stable/NEWS#L91","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7702","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7703","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7852","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug2919","tags":["article"]},{"url":"http://talosintel.com/reports/TALOS-2015-0063/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7977","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit","tags":["article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0074/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7978","tags":["advisory"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0075/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1242553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300273","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2583.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5196","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7974","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7974","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug2936","tags":["article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0071/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7979","tags":["advisory"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0076/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8158","tags":["advisory"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0080/","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2015-5195","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2783-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7871","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5195","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","status":"published","published":"2017-07-21T14:00:00Z","modified":"2024-08-06T06:41:07.979Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-5196","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","status":"published","published":"2017-07-21T14:00:00Z","modified":"2024-08-06T06:41:07Z","updated_at":"2026-11-03T02:22:01.305851Z"}],"ghsa":[{"id":"GHSA-rr6m-2g2v-4vm5","title":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of...","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","status":"published","published":"2022-05-14T03:22:58Z","modified":"2023-02-10T05:06:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:01.286462Z"}],"nvd":[{"id":"CVE-2015-5195","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","status":"published","published":"2017-07-21T14:29:00.82Z","modified":"2026-06-17T00:28:39.253Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"CVE-2015-5195","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","status":"published","published":"2017-07-21T14:29:00Z","modified":"2026-04-16T06:23:24.328825208Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5195","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","status":"published","published":"2017-07-21T14:29:00.82Z","modified":"2026-08-27T23:01:02.822970126Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-5195","description":"ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.","status":"published","published":"2015-08-25T00:00:00Z","modified":"2026-02-04T02:27:20.971535Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"DLA-335-1","title":"ntp - security update","status":"published","published":"2015-10-28T00:00:00Z","modified":"2026-03-09T01:23:37.230378Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3388-1","title":"ntp - security update","status":"published","published":"2015-11-01T00:00:00Z","modified":"2026-03-09T01:20:49.800811Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0348","title":"Updated ntp packages fix security vulnerabilities","description":"Updated ntp packages fix security vulnerability:\n\nA flaw was found in the way ntpd processed certain remote configuration\npackets. An attacker could use a specially crafted package to cause ntpd to\ncrash if the attacker had authenticated access to remote ntpd configuration\n(CVE-2015-5146).\n\nIt was found that ntpd could crash due to an uninitialized variable when\nprocessing malformed logconfig configuration commands, for example,\nntpq -c \":config logconfig a\" (CVE-2015-5194).\n\nIt was found that ntpd exits with a segmentation fault when a statistics\ntype that was not enabled during compilation (e.g. timingstats) is\nreferenced by the statistics or filegen configuration command, for example,\nntpq -c ':config statistics timingstats'\nntpq -c ':config filegen timingstats' (CVE-2015-5195).\n\nIt was found that the :config command can be used to set the pidfile and\ndriftfile paths without any restrictions. A remote attacker could use\nthis flaw to overwrite a file on the file system with a file containing\nthe pid of the ntpd process (immediately) or the current estimated drift\nof the system clock (in hourly intervals). For example,\nntpq -c ':config pidfile /tmp/ntp.pid'\nntpq -c ':config driftfile /tmp/ntp.drift' (CVE-2015-5196).\n\nIt was discovered that sntp would hang in an infinite loop when a\ncrafted NTP packet was received, related to the conversion of the\nprecision value in the packet to double (CVE-2015-5219).\n","status":"published","published":"2015-09-08T17:55:59Z","modified":"2026-04-16T06:23:59.384781567Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0780","title":"Red Hat Security Advisory: ntp security and bug fix update","status":"published","published":"2024-09-15T22:59:19Z","modified":"2026-06-26T12:21:51.625887391Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2583","title":"Red Hat Security Advisory: ntp security and bug fix update","status":"published","published":"2024-09-15T23:17:57Z","modified":"2026-06-26T12:21:52.461962277Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"USN-2783-1","title":"ntp vulnerabilities","description":"Aleksis Kauppinen discovered that NTP incorrectly handled certain remote\nconfig packets. In a non-default configuration, a remote authenticated\nattacker could possibly use this issue to cause NTP to crash, resulting in\na denial of service. (CVE-2015-5146)\n\nMiroslav Lichvar discovered that NTP incorrectly handled logconfig\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5194)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain statistics\ntypes. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5195)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain file\npaths. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service, or overwrite certain files. (CVE-2015-5196, CVE-2015-7703)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain packets.\nA remote attacker could possibly use this issue to cause NTP to hang,\nresulting in a denial of service. (CVE-2015-5219)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled restarting after hitting a panic threshold. A remote\nattacker could possibly use this issue to alter the system time on clients.\n(CVE-2015-5300)\n\nIt was discovered that NTP incorrectly handled autokey data packets. A\nremote attacker could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)\n\nIt was discovered that NTP incorrectly handled memory when processing\ncertain autokey messages. A remote attacker could possibly use this issue\nto cause NTP to consume memory, resulting in a denial of service.\n(CVE-2015-7701)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled rate limiting. A remote attacker could possibly use\nthis issue to cause clients to stop updating their clock. (CVE-2015-7704,\nCVE-2015-7705)\n\nYves Younan discovered that NTP incorrectly handled logfile and keyfile\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to enter a loop, resulting in a\ndenial of service. (CVE-2015-7850)\n\nYves Younan and Aleksander Nikolich discovered that NTP incorrectly handled\nascii conversion. A remote attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2015-7852)\n\nYves Younan discovered that NTP incorrectly handled reference clock memory.\nA malicious refclock could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7853)\n\nJohn D \"Doug\" Birdwell discovered that NTP incorrectly handled decoding\ncertain bogus values. An attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service. (CVE-2015-7855)\n\nStephen Gray discovered that NTP incorrectly handled symmetric association\nauthentication. A remote attacker could use this issue to possibly bypass\nauthentication and alter the system clock. (CVE-2015-7871)\n\nIn the default installation, attackers would be isolated by the NTP\nAppArmor profile.\n","status":"published","published":"2015-10-27T17:02:35Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}