{"id":"CVE-2015-7976","aliases":["DEBIAN-CVE-2015-7976","EUVD-2015-7873","GHSA-gh77-qwr7-pqm7","SUSE-SU-2016:1175-1","SUSE-SU-2016:1177-1","SUSE-SU-2016:1247-1","SUSE-SU-2016:1311-1","UBUNTU-CVE-2015-7976","USN-3096-1","openSUSE-SU-2024:10181-1"],"status":"published","title":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77...","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0358,"percentile":0.89484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-254"],"published":"2015-12-31T00:00:00Z","modified":"2026-08-27T23:02:15Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ntp","fixed_in":["1:4.2.8p4+dfsg-3ubuntu5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p7+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-46.5.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-46.5.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-46.5.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.14.1-1.12.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p4+dfsg-3ubuntu5.3"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p4+dfsg-3ubuntu5.3"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2"],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-1.1"}]}],"bundled":60}],"products":[{"vendor":"novell","product":"suse_openstack_cloud"},{"vendor":"ntp","product":"ntp"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"suse","product":"linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"manager"},{"vendor":"suse","product":"manager_proxy"},{"vendor":"suse","product":"suse_linux_enterprise_server"}],"references":[{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3096-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1034782","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.kb.cert.org/vuls/id/718152","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug2938","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20171031-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","advisory"]},{"url":"https://bto.bluecoat.com/security-advisory/sa113","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201607-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7976"},{"url":"https://security.netapp.com/advisory/ntap-20171031-0001"},{"url":"https://github.com/advisories/GHSA-gh77-qwr7-pqm7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-7976","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161175-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/782060","tags":["report"]},{"url":"https://bugzilla.suse.com/784760","tags":["report"]},{"url":"https://bugzilla.suse.com/916617","tags":["report"]},{"url":"https://bugzilla.suse.com/951559","tags":["report"]},{"url":"https://bugzilla.suse.com/951629","tags":["report"]},{"url":"https://bugzilla.suse.com/956773","tags":["report"]},{"url":"https://bugzilla.suse.com/962318","tags":["report"]},{"url":"https://bugzilla.suse.com/962784","tags":["report"]},{"url":"https://bugzilla.suse.com/962802","tags":["report"]},{"url":"https://bugzilla.suse.com/962960","tags":["report"]},{"url":"https://bugzilla.suse.com/962966","tags":["report"]},{"url":"https://bugzilla.suse.com/962970","tags":["report"]},{"url":"https://bugzilla.suse.com/962988","tags":["report"]},{"url":"https://bugzilla.suse.com/962994","tags":["report"]},{"url":"https://bugzilla.suse.com/962995","tags":["report"]},{"url":"https://bugzilla.suse.com/962997","tags":["report"]},{"url":"https://bugzilla.suse.com/963000","tags":["report"]},{"url":"https://bugzilla.suse.com/963002","tags":["report"]},{"url":"https://bugzilla.suse.com/975496","tags":["report"]},{"url":"https://bugzilla.suse.com/975981","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8158","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161177-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/937837","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161247-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/905885","tags":["report"]},{"url":"https://bugzilla.suse.com/910063","tags":["report"]},{"url":"https://bugzilla.suse.com/920238","tags":["report"]},{"url":"https://bugzilla.suse.com/926510","tags":["report"]},{"url":"https://bugzilla.suse.com/936327","tags":["report"]},{"url":"https://bugzilla.suse.com/942587","tags":["report"]},{"url":"https://bugzilla.suse.com/944300","tags":["report"]},{"url":"https://bugzilla.suse.com/946386","tags":["report"]},{"url":"https://bugzilla.suse.com/951608","tags":["report"]},{"url":"https://bugzilla.suse.com/954982","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7871","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161311-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/920183","tags":["report"]},{"url":"https://bugzilla.suse.com/942441","tags":["report"]},{"url":"https://bugzilla.suse.com/943216","tags":["report"]},{"url":"https://bugzilla.suse.com/943218","tags":["report"]},{"url":"https://bugzilla.suse.com/951351","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5219","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-7976","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit","tags":["report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0073/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3096-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4956","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9311","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-7976","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","status":"published","published":"2017-01-30T21:00:00Z","modified":"2024-08-06T08:06:31.303Z","updated_at":"2026-11-02T14:35:44.744952Z"}],"euvd":[{"id":"EUVD-2015-7873","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","status":"published","published":"2017-01-30T21:00:00Z","modified":"2024-08-06T08:06:31Z","updated_at":"2026-11-03T02:21:50.339607Z"}],"ghsa":[{"id":"GHSA-gh77-qwr7-pqm7","title":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77...","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","status":"published","published":"2022-05-14T02:04:28Z","modified":"2025-04-20T03:32:01Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:01:38.976438Z"}],"nvd":[{"id":"CVE-2015-7976","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","status":"published","published":"2017-01-30T21:59:00.33Z","modified":"2026-06-17T00:33:29.44Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-7976","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","status":"published","published":"2017-01-30T21:59:00Z","modified":"2026-04-10T03:45:29.120194Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-7976","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","status":"published","published":"2017-01-30T21:59:00.33Z","modified":"2026-08-27T23:02:15.391957792Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-7976","description":"The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.","status":"published","published":"2015-12-31T00:00:00Z","modified":"2026-02-04T03:32:51.272955Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"openSUSE-SU-2024:10181-1","title":"ntp-4.2.8p9-1.1 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:26.696395Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:1175-1","title":"Security update for ntp","description":"ntp was updated to version 4.2.8p6 to fix 12 security issues.\n\nThese security issues were fixed:\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP\n  (--enable-ntp-signd).  This replaces the w32 patches in 4.2.4 that added\n  the authreg directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- bsc#784760: Remove local clock from default configuration\n","status":"published","published":"2016-04-28T13:46:02Z","modified":"2026-02-04T02:57:39.769134Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1177-1","title":"Security update for ntp","description":"ntp was updated to version 4.2.8p6 to fix 12 security issues.\n\nAlso yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)\n\nThese security issues were fixed:\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP\n  (--enable-ntp-signd).  This replaces the w32 patches in 4.2.4 that added\n  the authreg directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n","status":"published","published":"2016-04-28T13:45:26Z","modified":"2026-02-04T04:14:10.491241Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1247-1","title":"Security update for ntp","description":"ntp was updated to version 4.2.8p6 to fix 28 security issues.\n\nMajor functional changes:\n- The 'sntp' commandline tool changed its option handling in a major way,\n  some options have been renamed or dropped.\n- 'controlkey 1' is added during update to ntp.conf to allow sntp to work.\n- The local clock is being disabled during update.\n- ntpd is no longer running chrooted.\n\nOther functional changes:\n- ntp-signd is installed.\n- 'enable mode7' can be added to the configuration to allow ntdpc to work as compatibility mode option.\n- 'kod' was removed from the default restrictions.\n- SHA1 keys are used by default instead of MD5 keys.\n\nAlso yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)\n\nThese security issues were fixed:\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n- CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608).\n- CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608).\n- CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608).\n- CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608).\n- CVE-2015-7850: remote config logfile-keyfile (bsc#951608).\n- CVE-2015-7849: trusted key use-after-free (bsc#951608).\n- CVE-2015-7848: mode 7 loop counter underrun (bsc#951608).\n- CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608).\n- CVE-2015-7703: configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#951608).\n- CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608).\n- CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd).\n  This replaces the w32 patches in 4.2.4 that added the authreg\n  directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq.\n- bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution.\n- bsc#905885: Use SHA1 instead of MD5 for symmetric keys.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- Fix legacy action scripts to pass on command line arguments.\n- bsc#944300: Remove 'kod' from the restrict line in ntp.conf.\n- bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd.\n- Add a controlkey to ntp.conf to make the above work.\n- Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.\n- Disable mode 7 (ntpdc) again, now that we don't use it anymore.\n- Add 'addserver' as a new legacy action.\n- bsc#910063: Fix the comment regarding addserver in ntp.conf.\n- bsc#926510: Disable chroot by default.\n- bsc#920238: Enable ntpdc for backwards compatibility.\n","status":"published","published":"2016-05-06T07:50:51Z","modified":"2026-02-04T03:41:19.510535Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1311-1","title":"Security update for ntp","description":"\nThis network time protocol server ntp was updated to 4.2.8p6 to fix the following\nissues:\n\nAlso yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)\n\nMajor functional changes:\n- The 'sntp' commandline tool changed its option handling in a major way.\n- 'controlkey 1' is added during update to ntp.conf to allow sntp to work.\n- The local clock is being disabled during update.\n- ntpd is no longer running chrooted.\n\n\nOther functional changes:\n- ntp-signd is installed.\n- 'enable mode7' can be added to the configuration to allow ntdpc to work as compatibility mode option.\n- 'kod' was removed from the default restrictions.\n- SHA1 keys are used by default instead of MD5 keys.\n\nThese security issues were fixed:\n- CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216).\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n- CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608).\n- CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608).\n- CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608).\n- CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608).\n- CVE-2015-7850: remote config logfile-keyfile (bsc#951608).\n- CVE-2015-7849: trusted key use-after-free (bsc#951608).\n- CVE-2015-7848: mode 7 loop counter underrun (bsc#951608).\n- CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608).\n- CVE-2015-7703: configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#951608).\n- CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608).\n- CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd).\n  This replaces the w32 patches in 4.2.4 that added the authreg\n  directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq.\n- bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution.\n- bsc#905885: Use SHA1 instead of MD5 for symmetric keys.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- Fix legacy action scripts to pass on command line arguments.\n- bsc#944300: Remove 'kod' from the restrict line in ntp.conf.\n- bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd.\n- Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.\n- Disable mode 7 (ntpdc) again, now that we don't use it anymore.\n- Add 'addserver' as a new legacy action.\n- bsc#910063: Fix the comment regarding addserver in ntp.conf.\n- bsc#926510: Disable chroot by default.\n- bsc#920238: Enable ntpdc for backwards compatibility.\n- bsc#784760: Remove local clock from default configuration.\n- bsc#942441/fate#319496: Require perl-Socket6.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- bsc#920183: Allow -4 and -6 address qualifiers in 'server' directives.\n- Use upstream ntp-wait, because our version is incompatible with\n  the new ntpq command line syntax.\n","status":"published","published":"2016-05-17T09:29:35Z","modified":"2026-02-04T04:38:27.911087Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3096-1","title":"ntp vulnerabilities","description":"Aanchal Malhotra discovered that NTP incorrectly handled authenticated\nbroadcast mode. A remote attacker could use this issue to perform a replay\nattack. (CVE-2015-7973)\n\nMatt Street discovered that NTP incorrectly verified peer associations of\nsymmetric keys. A remote attacker could use this issue to perform an\nimpersonation attack. (CVE-2015-7974)\n\nJonathan Gardner discovered that the NTP ntpq utility incorrectly handled\nmemory. An attacker could possibly use this issue to cause ntpq to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04\nLTS. (CVE-2015-7975)\n\nJonathan Gardner discovered that the NTP ntpq utility incorrectly handled\ndangerous characters in filenames. An attacker could possibly use this\nissue to overwrite arbitrary files. (CVE-2015-7976)\n\nStephen Gray discovered that NTP incorrectly handled large restrict lists.\nAn attacker could use this issue to cause NTP to crash, resulting in a\ndenial of service. (CVE-2015-7977, CVE-2015-7978)\n\nAanchal Malhotra discovered that NTP incorrectly handled authenticated\nbroadcast mode. A remote attacker could use this issue to cause NTP to\ncrash, resulting in a denial of service. (CVE-2015-7979)\n\nJonathan Gardner discovered that NTP incorrectly handled origin timestamp\nchecks. A remote attacker could use this issue to spoof peer servers.\n(CVE-2015-8138)\n\nJonathan Gardner discovered that the NTP ntpq utility did not properly\nhandle certain incorrect values. An attacker could possibly use this issue\nto cause ntpq to hang, resulting in a denial of service. (CVE-2015-8158)\n\nIt was discovered that the NTP cronjob incorrectly cleaned up the\nstatistics directory. A local attacker could possibly use this to escalate\nprivileges. (CVE-2016-0727)\n\nStephen Gray and Matthew Van Gundy discovered that NTP incorrectly\nvalidated crypto-NAKs. A remote attacker could possibly use this issue to\nprevent clients from synchronizing. (CVE-2016-1547)\n\nMiroslav Lichvar and Jonathan Gardner discovered that NTP incorrectly\nhandled switching to interleaved symmetric mode. A remote attacker could\npossibly use this issue to prevent clients from synchronizing.\n(CVE-2016-1548)\n\nMatthew Van Gundy, Stephen Gray and Loganaden Velvindron discovered that\nNTP incorrectly handled message authentication. A remote attacker could\npossibly use this issue to recover the message digest key. (CVE-2016-1550)\n\nYihan Lian discovered that NTP incorrectly handled duplicate IPs on\nunconfig directives. An authenticated remote attacker could possibly use\nthis issue to cause NTP to crash, resulting in a denial of service.\n(CVE-2016-2516)\n\nYihan Lian discovered that NTP incorrectly handled certail peer\nassociations. A remote attacker could possibly use this issue to cause NTP\nto crash, resulting in a denial of service. (CVE-2016-2518)\n\nJakub Prokes discovered that NTP incorrectly handled certain spoofed\npackets. A remote attacker could possibly use this issue to cause a denial\nof service. (CVE-2016-4954)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain packets\nwhen autokey is enabled. A remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2016-4955)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain spoofed\nbroadcast packets. A remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2016-4956)\n\nIn the default installation, attackers would be isolated by the NTP\nAppArmor profile.\n","status":"published","published":"2016-10-05T18:01:12Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}