{"id":"CVE-2015-5219","aliases":["DEBIAN-CVE-2015-5219","DLA-335-1","DSA-3388-1","EUVD-2015-5216","GHSA-38qh-x54p-8w2g","MGASA-2015-0348","RHSA-2016:0780","RHSA-2016:2583","SUSE-SU-2016:1311-1","SUSE-SU-2016:3193-1","SUSE-SU-2016:3195-1","SUSE-SU-2016:3196-1","SUSE-SU-2017:0255-1","UBUNTU-CVE-2015-5219","USN-2783-1"],"status":"published","title":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions...","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06089,"percentile":0.93459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-704"],"published":"2015-08-25T00:00:00Z","modified":"2026-08-27T23:01:03Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p2+dfsg-1+deb6u4"}]}],"versions":["1:4.2.6.p2+dfsg-1"],"bundled":16},{"source":"osv","ecosystem":"Debian:7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-2+deb7u6"}]}],"versions":["1:4.2.6.p5+dfsg-2","1:4.2.6.p5+dfsg-2+deb7u1","1:4.2.6.p5+dfsg-2+deb7u2","1:4.2.6.p5+dfsg-2+deb7u3","1:4.2.6.p5+dfsg-2+deb7u4","1:4.2.6.p5+dfsg-2+deb7u5"],"bundled":16},{"source":"osv","ecosystem":"Debian:8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-7+deb8u1"}]}],"versions":["1:4.2.6.p5+dfsg-7"],"bundled":16},{"source":"osv","ecosystem":"Mageia:4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-15.6.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-24.1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-10.el6"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-25.el7"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.14.1-1.12.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-57.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-57.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-55.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-55.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-55.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-55.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-55.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-55.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-55.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-46.18.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-46.18.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"],"bundled":18}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"novell","product":"leap"},{"vendor":"ntp","product":"ntp"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"siemens","product":"tim_4r-id_dnp3_firmware"},{"vendor":"siemens","product":"tim_4r-ie_firmware"},{"vendor":"suse","product":"linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"manager"},{"vendor":"suse","product":"manager_proxy"},{"vendor":"suse","product":"openstack_cloud"}],"references":[{"url":"http://aix.software.ibm.com/aix/efixes/security/ntp_advisory4.asc","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=isg3T1024157","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/ntp-project/ntp/commit/5f295cd05c3c136d39f5b3e500a2d781bdbb59c8","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099409","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2783-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21986956","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21988706","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2583.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://bk1.ntp.org/ntp-dev/?PAGE=patch\u0026REV=51786731Gr4-NOrTBC_a_uXO4wuGhg","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0780.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3388","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/08/25/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1255118","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.securityfocus.com/bid/76473","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21989542","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21985122","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5219","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0780","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2583","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5219","tags":["report"]},{"url":"https://github.com/advisories/GHSA-38qh-x54p-8w2g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5219","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0348.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16322","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2015/08/25/3","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Release_Notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.8_Technical_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1254542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1254544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1254547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1274254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1274255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1274261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1286969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300270","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0780.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5194","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5194","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5195","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5219","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7691","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner","tags":["article"]},{"url":"https://github.com/ntp-project/ntp/blob/stable/NEWS#L11","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7701","tags":["advisory"]},{"url":"https://github.com/ntp-project/ntp/blob/stable/NEWS#L91","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7702","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7703","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7852","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug2919","tags":["article"]},{"url":"http://talosintel.com/reports/TALOS-2015-0063/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7977","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit","tags":["article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0074/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7978","tags":["advisory"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0075/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1242553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1300273","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2583.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5196","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7974","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7974","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug2936","tags":["article"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0071/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7979","tags":["advisory"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0076/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8158","tags":["advisory"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0080/","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161311-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/782060","tags":["report"]},{"url":"https://bugzilla.suse.com/784760","tags":["report"]},{"url":"https://bugzilla.suse.com/905885","tags":["report"]},{"url":"https://bugzilla.suse.com/910063","tags":["report"]},{"url":"https://bugzilla.suse.com/916617","tags":["report"]},{"url":"https://bugzilla.suse.com/920183","tags":["report"]},{"url":"https://bugzilla.suse.com/920238","tags":["report"]},{"url":"https://bugzilla.suse.com/926510","tags":["report"]},{"url":"https://bugzilla.suse.com/936327","tags":["report"]},{"url":"https://bugzilla.suse.com/937837","tags":["report"]},{"url":"https://bugzilla.suse.com/942441","tags":["report"]},{"url":"https://bugzilla.suse.com/942587","tags":["report"]},{"url":"https://bugzilla.suse.com/943216","tags":["report"]},{"url":"https://bugzilla.suse.com/943218","tags":["report"]},{"url":"https://bugzilla.suse.com/944300","tags":["report"]},{"url":"https://bugzilla.suse.com/946386","tags":["report"]},{"url":"https://bugzilla.suse.com/951351","tags":["report"]},{"url":"https://bugzilla.suse.com/951559","tags":["report"]},{"url":"https://bugzilla.suse.com/951608","tags":["report"]},{"url":"https://bugzilla.suse.com/951629","tags":["report"]},{"url":"https://bugzilla.suse.com/954982","tags":["report"]},{"url":"https://bugzilla.suse.com/956773","tags":["report"]},{"url":"https://bugzilla.suse.com/962318","tags":["report"]},{"url":"https://bugzilla.suse.com/962784","tags":["report"]},{"url":"https://bugzilla.suse.com/962802","tags":["report"]},{"url":"https://bugzilla.suse.com/962960","tags":["report"]},{"url":"https://bugzilla.suse.com/962966","tags":["report"]},{"url":"https://bugzilla.suse.com/962970","tags":["report"]},{"url":"https://bugzilla.suse.com/962988","tags":["report"]},{"url":"https://bugzilla.suse.com/962994","tags":["report"]},{"url":"https://bugzilla.suse.com/962995","tags":["report"]},{"url":"https://bugzilla.suse.com/962997","tags":["report"]},{"url":"https://bugzilla.suse.com/963000","tags":["report"]},{"url":"https://bugzilla.suse.com/963002","tags":["report"]},{"url":"https://bugzilla.suse.com/975496","tags":["report"]},{"url":"https://bugzilla.suse.com/975981","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8158","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163193-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009434","tags":["report"]},{"url":"https://bugzilla.suse.com/1011377","tags":["report"]},{"url":"https://bugzilla.suse.com/1011390","tags":["report"]},{"url":"https://bugzilla.suse.com/1011395","tags":["report"]},{"url":"https://bugzilla.suse.com/1011398","tags":["report"]},{"url":"https://bugzilla.suse.com/1011404","tags":["report"]},{"url":"https://bugzilla.suse.com/1011406","tags":["report"]},{"url":"https://bugzilla.suse.com/1011411","tags":["report"]},{"url":"https://bugzilla.suse.com/1011417","tags":["report"]},{"url":"https://bugzilla.suse.com/956365","tags":["report"]},{"url":"https://bugzilla.suse.com/981252","tags":["report"]},{"url":"https://bugzilla.suse.com/988028","tags":["report"]},{"url":"https://bugzilla.suse.com/992038","tags":["report"]},{"url":"https://bugzilla.suse.com/992606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9311","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163195-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163196-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170255-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5219","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2783-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7871","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5219","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","status":"published","published":"2017-07-21T14:00:00Z","modified":"2024-08-06T06:41:08.551Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-5216","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","status":"published","published":"2017-07-21T14:00:00Z","modified":"2024-08-06T06:41:08Z","updated_at":"2026-11-03T02:22:01.305851Z"}],"ghsa":[{"id":"GHSA-38qh-x54p-8w2g","title":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions...","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","status":"published","published":"2022-05-13T01:10:46Z","modified":"2023-02-10T05:06:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:54:02.310741Z"}],"nvd":[{"id":"CVE-2015-5219","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","status":"published","published":"2017-07-21T14:29:00.867Z","modified":"2026-06-17T00:28:41.89Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-704"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"CVE-2015-5219","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","status":"published","published":"2017-07-21T14:29:00Z","modified":"2026-04-16T06:20:18.479686477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5219","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","status":"published","published":"2017-07-21T14:29:00.867Z","modified":"2026-08-27T23:01:03.269330349Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-5219","description":"The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.","status":"published","published":"2015-08-25T00:00:00Z","modified":"2026-02-04T02:17:46.534688Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"DLA-335-1","title":"ntp - security update","status":"published","published":"2015-10-28T00:00:00Z","modified":"2026-03-09T01:23:37.230378Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3388-1","title":"ntp - security update","status":"published","published":"2015-11-01T00:00:00Z","modified":"2026-03-09T01:20:49.800811Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0348","title":"Updated ntp packages fix security vulnerabilities","description":"Updated ntp packages fix security vulnerability:\n\nA flaw was found in the way ntpd processed certain remote configuration\npackets. An attacker could use a specially crafted package to cause ntpd to\ncrash if the attacker had authenticated access to remote ntpd configuration\n(CVE-2015-5146).\n\nIt was found that ntpd could crash due to an uninitialized variable when\nprocessing malformed logconfig configuration commands, for example,\nntpq -c \":config logconfig a\" (CVE-2015-5194).\n\nIt was found that ntpd exits with a segmentation fault when a statistics\ntype that was not enabled during compilation (e.g. timingstats) is\nreferenced by the statistics or filegen configuration command, for example,\nntpq -c ':config statistics timingstats'\nntpq -c ':config filegen timingstats' (CVE-2015-5195).\n\nIt was found that the :config command can be used to set the pidfile and\ndriftfile paths without any restrictions. A remote attacker could use\nthis flaw to overwrite a file on the file system with a file containing\nthe pid of the ntpd process (immediately) or the current estimated drift\nof the system clock (in hourly intervals). For example,\nntpq -c ':config pidfile /tmp/ntp.pid'\nntpq -c ':config driftfile /tmp/ntp.drift' (CVE-2015-5196).\n\nIt was discovered that sntp would hang in an infinite loop when a\ncrafted NTP packet was received, related to the conversion of the\nprecision value in the packet to double (CVE-2015-5219).\n","status":"published","published":"2015-09-08T17:55:59Z","modified":"2026-04-16T06:23:59.384781567Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0780","title":"Red Hat Security Advisory: ntp security and bug fix update","status":"published","published":"2024-09-15T22:59:19Z","modified":"2026-06-26T12:21:51.625887391Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2583","title":"Red Hat Security Advisory: ntp security and bug fix update","status":"published","published":"2024-09-15T23:17:57Z","modified":"2026-06-26T12:21:52.461962277Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:1311-1","title":"Security update for ntp","description":"\nThis network time protocol server ntp was updated to 4.2.8p6 to fix the following\nissues:\n\nAlso yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)\n\nMajor functional changes:\n- The 'sntp' commandline tool changed its option handling in a major way.\n- 'controlkey 1' is added during update to ntp.conf to allow sntp to work.\n- The local clock is being disabled during update.\n- ntpd is no longer running chrooted.\n\n\nOther functional changes:\n- ntp-signd is installed.\n- 'enable mode7' can be added to the configuration to allow ntdpc to work as compatibility mode option.\n- 'kod' was removed from the default restrictions.\n- SHA1 keys are used by default instead of MD5 keys.\n\nThese security issues were fixed:\n- CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216).\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n- CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608).\n- CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608).\n- CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608).\n- CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608).\n- CVE-2015-7850: remote config logfile-keyfile (bsc#951608).\n- CVE-2015-7849: trusted key use-after-free (bsc#951608).\n- CVE-2015-7848: mode 7 loop counter underrun (bsc#951608).\n- CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608).\n- CVE-2015-7703: configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#951608).\n- CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608).\n- CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd).\n  This replaces the w32 patches in 4.2.4 that added the authreg\n  directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq.\n- bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution.\n- bsc#905885: Use SHA1 instead of MD5 for symmetric keys.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- Fix legacy action scripts to pass on command line arguments.\n- bsc#944300: Remove 'kod' from the restrict line in ntp.conf.\n- bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd.\n- Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.\n- Disable mode 7 (ntpdc) again, now that we don't use it anymore.\n- Add 'addserver' as a new legacy action.\n- bsc#910063: Fix the comment regarding addserver in ntp.conf.\n- bsc#926510: Disable chroot by default.\n- bsc#920238: Enable ntpdc for backwards compatibility.\n- bsc#784760: Remove local clock from default configuration.\n- bsc#942441/fate#319496: Require perl-Socket6.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- bsc#920183: Allow -4 and -6 address qualifiers in 'server' directives.\n- Use upstream ntp-wait, because our version is incompatible with\n  the new ntpq command line syntax.\n","status":"published","published":"2016-05-17T09:29:35Z","modified":"2026-02-04T04:38:27.911087Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3193-1","title":"Security update for ntp","description":"\nThis update for ntp fixes the following issues:\n\n- Simplify ntpd's search for its own executable to prevent AppArmor\n  warnings (bsc#956365).\n\nSecurity issues fixed (update to 4.2.8p9):\n\n- CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6\n  unauthenticated trap information disclosure and DDoS vector.\n- CVE-2016-7427, bsc#1011390:\n  Broadcast Mode Replay Prevention DoS.\n- CVE-2016-7428, bsc#1011417:\n  Broadcast Mode Poll Interval Enforcement DoS.\n- CVE-2016-7431, bsc#1011395:\n  Regression: 010-origin: Zero Origin Timestamp Bypass.\n- CVE-2016-7434, bsc#1011398:\n  Null pointer dereference in _IO_str_init_static_internal().\n- CVE-2016-7429, bsc#1011404: Interface selection attack.\n- CVE-2016-7426, bsc#1011406:\n  Client rate limiting and server responses.\n- CVE-2016-7433, bsc#1011411: Reboot sync calculation problem.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n- CVE-2015-8140: ntpq vulnerable to replay attacks.\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n\nNon-security issues fixed:\n\n- Fix a spurious error message.\n- Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog.\n- Fix a regression in 'trap' (bsc#981252).\n- Reduce the number of netlink groups to listen on for changes to\n  the local network setup (bsc#992606).\n- Fix segfault in 'sntp -a' (bsc#1009434).\n- Silence an OpenSSL version warning (bsc#992038).\n- Make the resolver task change user and group IDs to the same\n  values as the main task. (bsc#988028)\n\n","status":"published","published":"2016-12-19T16:07:30Z","modified":"2026-02-04T03:40:02.425004Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2016:3195-1","title":"Security update for ntp","description":"\nThis update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p9.\n\nSecurity issues fixed:\n\n- CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6\n  unauthenticated trap information disclosure and DDoS vector.\n- CVE-2016-7427, bsc#1011390:\n  Broadcast Mode Replay Prevention DoS.\n- CVE-2016-7428, bsc#1011417:\n  Broadcast Mode Poll Interval Enforcement DoS.\n- CVE-2016-7431, bsc#1011395:\n  Regression: 010-origin: Zero Origin Timestamp Bypass.\n- CVE-2016-7434, bsc#1011398:\n  Null pointer dereference in _IO_str_init_static_internal().\n- CVE-2016-7429, bsc#1011404: Interface selection attack.\n- CVE-2016-7426, bsc#1011406:\n  Client rate limiting and server responses.\n- CVE-2016-7433, bsc#1011411: Reboot sync calculation problem.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n\nNon-security issues fixed:\n\n- Fix a spurious error message.\n- Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog.\n- Fix a regression in 'trap' (bsc#981252).\n- Reduce the number of netlink groups to listen on for changes to\n  the local network setup (bsc#992606).\n- Fix segfault in 'sntp -a' (bsc#1009434).\n- Silence an OpenSSL version warning (bsc#992038).\n- Make the resolver task change user and group IDs to the same\n  values as the main task. (bsc#988028)\n- Simplify ntpd's search for its own executable to prevent AppArmor\n  warnings (bsc#956365).\n\n","status":"published","published":"2016-12-19T16:08:04Z","modified":"2026-02-04T03:30:53.869251Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2016:3196-1","title":"Security update for ntp","description":"\nThis update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p9.\n\nSecurity issues fixed:\n\n- CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6\n  unauthenticated trap information disclosure and DDoS vector.\n- CVE-2016-7427, bsc#1011390:\n  Broadcast Mode Replay Prevention DoS.\n- CVE-2016-7428, bsc#1011417:\n  Broadcast Mode Poll Interval Enforcement DoS.\n- CVE-2016-7431, bsc#1011395:\n  Regression: 010-origin: Zero Origin Timestamp Bypass.\n- CVE-2016-7434, bsc#1011398:\n  Null pointer dereference in _IO_str_init_static_internal().\n- CVE-2016-7429, bsc#1011404: Interface selection attack.\n- CVE-2016-7426, bsc#1011406:\n  Client rate limiting and server responses.\n- CVE-2016-7433, bsc#1011411: Reboot sync calculation problem.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n\nNon-security issues fixed:\n\n- Fix a spurious error message.\n- Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog.\n- Fix a regression in 'trap' (bsc#981252).\n- Reduce the number of netlink groups to listen on for changes to\n  the local network setup (bsc#992606).\n- Fix segfault in 'sntp -a' (bsc#1009434).\n- Silence an OpenSSL version warning (bsc#992038).\n- Make the resolver task change user and group IDs to the same\n  values as the main task. (bsc#988028)\n- Simplify ntpd's search for its own executable to prevent AppArmor\n  warnings (bsc#956365).\n\n","status":"published","published":"2016-12-19T16:07:40Z","modified":"2025-05-02T04:04:40.260632Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0255-1","title":"Security update for ntp","description":"\nThis update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p9.\n\nSecurity issues fixed:\n\n- CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6\n  unauthenticated trap information disclosure and DDoS vector.\n- CVE-2016-7427, bsc#1011390:\n  Broadcast Mode Replay Prevention DoS.\n- CVE-2016-7428, bsc#1011417:\n  Broadcast Mode Poll Interval Enforcement DoS.\n- CVE-2016-7431, bsc#1011395:\n  Regression: 010-origin: Zero Origin Timestamp Bypass.\n- CVE-2016-7434, bsc#1011398:\n  Null pointer dereference in _IO_str_init_static_internal().\n- CVE-2016-7429, bsc#1011404: Interface selection attack.\n- CVE-2016-7426, bsc#1011406:\n  Client rate limiting and server responses.\n- CVE-2016-7433, bsc#1011411: Reboot sync calculation problem.\n- CVE-2015-8140: ntpq vulnerable to replay attacks.\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n\nNon-security issues fixed:\n\n- Fix a spurious error message.\n- Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog.\n- Fix a regression in 'trap' (bsc#981252).\n- Reduce the number of netlink groups to listen on for changes to\n  the local network setup (bsc#992606).\n- Fix segfault in 'sntp -a' (bsc#1009434).\n- Silence an OpenSSL version warning (bsc#992038).\n- Make the resolver task change user and group IDs to the same\n  values as the main task. (bsc#988028)\n- Simplify ntpd's search for its own executable to prevent AppArmor\n  warnings (bsc#956365).\n\n","status":"published","published":"2017-01-23T11:27:30Z","modified":"2026-02-04T03:28:16.725221Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-2783-1","title":"ntp vulnerabilities","description":"Aleksis Kauppinen discovered that NTP incorrectly handled certain remote\nconfig packets. In a non-default configuration, a remote authenticated\nattacker could possibly use this issue to cause NTP to crash, resulting in\na denial of service. (CVE-2015-5146)\n\nMiroslav Lichvar discovered that NTP incorrectly handled logconfig\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5194)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain statistics\ntypes. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5195)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain file\npaths. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service, or overwrite certain files. (CVE-2015-5196, CVE-2015-7703)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain packets.\nA remote attacker could possibly use this issue to cause NTP to hang,\nresulting in a denial of service. (CVE-2015-5219)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled restarting after hitting a panic threshold. A remote\nattacker could possibly use this issue to alter the system time on clients.\n(CVE-2015-5300)\n\nIt was discovered that NTP incorrectly handled autokey data packets. A\nremote attacker could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)\n\nIt was discovered that NTP incorrectly handled memory when processing\ncertain autokey messages. A remote attacker could possibly use this issue\nto cause NTP to consume memory, resulting in a denial of service.\n(CVE-2015-7701)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled rate limiting. A remote attacker could possibly use\nthis issue to cause clients to stop updating their clock. (CVE-2015-7704,\nCVE-2015-7705)\n\nYves Younan discovered that NTP incorrectly handled logfile and keyfile\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to enter a loop, resulting in a\ndenial of service. (CVE-2015-7850)\n\nYves Younan and Aleksander Nikolich discovered that NTP incorrectly handled\nascii conversion. A remote attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2015-7852)\n\nYves Younan discovered that NTP incorrectly handled reference clock memory.\nA malicious refclock could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7853)\n\nJohn D \"Doug\" Birdwell discovered that NTP incorrectly handled decoding\ncertain bogus values. An attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service. (CVE-2015-7855)\n\nStephen Gray discovered that NTP incorrectly handled symmetric association\nauthentication. A remote attacker could use this issue to possibly bypass\nauthentication and alter the system clock. (CVE-2015-7871)\n\nIn the default installation, attackers would be isolated by the NTP\nAppArmor profile.\n","status":"published","published":"2015-10-27T17:02:35Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}