{"id":"CVE-2019-8936","aliases":["CLSA-2026-1777453146","CLSA-2026-1777453307","DEBIAN-CVE-2019-8936","EUVD-2019-18324","GHSA-54w8-prj8-6v5f","MGASA-2019-0140","SUSE-SU-2019:0775-1","SUSE-SU-2019:0777-1","SUSE-SU-2019:0789-1","SUSE-SU-2019:13991-1","SUSE-SU-2019:14004-1","UBUNTU-CVE-2019-8936","USN-4563-1","USN-4563-2","openSUSE-SU-2019:1143-1","openSUSE-SU-2024:11102-1"],"status":"published","title":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05726,"percentile":0.93094,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-476"],"published":"2019-03-27T09:37:42Z","modified":"2026-08-29T07:02:52Z","exploits":[{"source":"pocgithub","id":"snappyJack/CVE-2019-8936","title":"snappyJack/CVE-2019-8936","date":"2020-04-26","url":"https://github.com/snappyJack/CVE-2019-8936"}],"fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p12+dfsg-4"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"ntp","fixed_in":["4.2.8p13-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"ntp","fixed_in":["4.2.8p13-46.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"ntp","fixed_in":["4.2.8p13-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"ntp","fixed_in":["4.2.8p13-85.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","fixed_in":["4.2.8p13-64.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","fixed_in":["4.2.8p13-64.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"ntp","fixed_in":["4.2.8p13-48.27.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ntp","fixed_in":["1:4.2.8p10+dfsg-5ubuntu7.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ntp","fixed_in":["1:4.2.8p12+dfsg-3ubuntu4.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ntp","fixed_in":["1:4.2.8p12+dfsg-3ubuntu6"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"ntp","fixed_in":["4.2.8p13-lp150.8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-16.el6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p12+dfsg-4"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-46.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-85.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-64.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-64.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-48.27.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p10+dfsg-5ubuntu7.3"}]}],"versions":["1:4.2.8p10+dfsg-5ubuntu3","1:4.2.8p10+dfsg-5ubuntu4","1:4.2.8p10+dfsg-5ubuntu5","1:4.2.8p10+dfsg-5ubuntu6","1:4.2.8p10+dfsg-5ubuntu7","1:4.2.8p10+dfsg-5ubuntu7.1","1:4.2.8p10+dfsg-5ubuntu7.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p12+dfsg-3ubuntu4.20.04.1"}]}],"versions":["1:4.2.8p12+dfsg-3ubuntu2","1:4.2.8p12+dfsg-3ubuntu3","1:4.2.8p12+dfsg-3ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p12+dfsg-3ubuntu6"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p10+dfsg-5ubuntu7.3"}]}],"versions":["1:4.2.8p10+dfsg-5ubuntu3","1:4.2.8p10+dfsg-5ubuntu4","1:4.2.8p10+dfsg-5ubuntu5","1:4.2.8p10+dfsg-5ubuntu6","1:4.2.8p10+dfsg-5ubuntu7","1:4.2.8p10+dfsg-5ubuntu7.1","1:4.2.8p10+dfsg-5ubuntu7.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p12+dfsg-3ubuntu4.20.04.1"}]}],"versions":["1:4.2.8p12+dfsg-3ubuntu2","1:4.2.8p12+dfsg-3ubuntu3","1:4.2.8p12+dfsg-3ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p13-lp150.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-7.2"}]}],"bundled":18}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"hpe","product":"hpux-ntp"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"data_ontap"},{"vendor":"ntp","product":"ntp"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://security.gentoo.org/glsa/201903-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQDNHNYOJK2SRSGO23GQ2RXTOUY2HLNN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBGXY7OKWOLT6X6JAPVZRFEP4FLCGGST/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NVS2CSG2TQ663CXOZZUJN4STQPMENNP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190503-0001/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-19:04.ntp.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","Mitigation","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/May/39","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","report"]},{"url":"http://bugs.ntp.org/show_bug.cgi?id=3565","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"http://packetstormsecurity.com/files/152915/FreeBSD-Security-Advisory-FreeBSD-SA-19-04.ntp.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://support.f5.com/csp/article/K61363039","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4563-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8936"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NVS2CSG2TQ663CXOZZUJN4STQPMENNP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBGXY7OKWOLT6X6JAPVZRFEP4FLCGGST"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQDNHNYOJK2SRSGO23GQ2RXTOUY2HLNN"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NVS2CSG2TQ663CXOZZUJN4STQPMENNP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBGXY7OKWOLT6X6JAPVZRFEP4FLCGGST"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQDNHNYOJK2SRSGO23GQ2RXTOUY2HLNN"},{"url":"https://security.netapp.com/advisory/ntap-20190503-0001"},{"url":"https://usn.ubuntu.com/4563-1"},{"url":"https://github.com/advisories/GHSA-54w8-prj8-6v5f"},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1777453146.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1777453307.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-8936","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0140.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24585","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2019-March/005258.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190775-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1128525","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8936","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190777-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190789-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125401","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913991-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001182","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914004-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-8936","tags":["report"]},{"url":"http://bk.ntp.org/ntp-stable/ntpd/ntp_control.c?PAGE=diffs\u0026REV=5c8106e7wWtXdh0lzg1ytlWribBTcQ","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4563-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4563-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8936","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EAPUXDEF7NLAPPMGD5IXCEOETMLBUN2T/#EAPUXDEF7NLAPPMGD5IXCEOETMLBUN2T","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15025","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-8936","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","status":"published","published":"2019-05-15T15:37:31Z","modified":"2024-08-04T21:31:37.562Z","updated_at":"2026-11-02T14:20:21.703364Z"}],"euvd":[{"id":"EUVD-2019-18324","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","status":"published","published":"2019-05-15T15:37:31Z","modified":"2024-08-04T21:31:37Z","updated_at":"2026-11-03T03:06:40.999783Z"}],"ghsa":[{"id":"GHSA-54w8-prj8-6v5f","title":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","status":"published","published":"2022-05-24T16:45:44Z","modified":"2024-04-04T00:39:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:55:51.119563Z"}],"nvd":[{"id":"CVE-2019-8936","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","status":"published","published":"2019-05-15T16:29:01.223Z","modified":"2026-06-17T02:42:48.91Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:13.880207Z"}],"osv":[{"id":"CVE-2019-8936","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","status":"published","published":"2019-05-15T16:29:01.223Z","modified":"2026-04-16T04:32:35.465221218Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-8936","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","status":"published","published":"2019-05-15T16:29:01.223Z","modified":"2026-08-29T07:02:52.083906518Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-8936","description":"NTP through 4.2.8p12 has a NULL Pointer Dereference.","status":"published","published":"2019-05-15T16:29:00Z","modified":"2026-02-04T04:39:54.157319Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"CLSA-2026-1777453146","title":"ntp: Fix of 2 CVEs","description":"- CVE-2018-7185: unauthenticated packet with a zero-origin timestamp can\n  reset an authenticated interleave association leading to denial of service.\n- CVE-2019-8936: NULL pointer dereference triggered by an authenticated\n  mode 6 control packet with no value field.","status":"published","published":"2026-05-02T00:51:53Z","modified":"2026-06-01T00:33:16.994141331Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777453307","title":"ntp: Fix of 2 CVEs","description":"- CVE-2018-7185: unauthenticated packet with a zero-origin timestamp can\n  reset an authenticated interleave association leading to denial of service.\n- CVE-2019-8936: NULL pointer dereference triggered by an authenticated\n  mode 6 control packet with no value field.","status":"published","published":"2026-04-29T09:01:52Z","modified":"2026-06-01T00:33:25.962780871Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"MGASA-2019-0140","title":"Updated ntp packages fix security vulnerability","description":"A null pointer exception which could allow an authenticated attacker to\ncause segmentation fault to ntpd. (CVE-2019-8936)\n","status":"published","published":"2019-04-10T21:25:19Z","modified":"2026-04-16T04:43:45.886258938Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1143-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nSecurity issue fixed: \t  \n\n- CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause \n  segmentation fault to ntpd (bsc#1128525).\n\nOther issues addressed:\n\n- Fixed several bugs in the BANCOMM reclock driver.\n- Fixed ntp_loopfilter.c snprintf compilation warnings.\n- Fixed spurious initgroups() error message.\n- Fixed STA_NANO struct timex units.\n- Fixed GPS week rollover in libparse.\n- Fixed incorrect poll interval in packet.\n- Added a missing check for ENABLE_CMAC.\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-04T14:12:28Z","modified":"2026-02-04T02:28:12.097397Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11102-1","title":"ntp-4.2.8p15-7.2 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:15.257534Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0775-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\t  \nSecurity issue fixed: \t  \n\n- CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause \n  segmentation fault to ntpd (bsc#1128525).\n\nOther issues addressed:\n\n- Fixed several bugs in the BANCOMM reclock driver.\n- Fixed ntp_loopfilter.c snprintf compilation warnings.\n- Fixed spurious initgroups() error message.\n- Fixed STA_NANO struct timex units.\n- Fixed GPS week rollover in libparse.\n- Fixed incorrect poll interval in packet.\n- Added a missing check for ENABLE_CMAC.\n","status":"published","published":"2019-03-27T10:38:39Z","modified":"2026-02-04T04:02:33.397344Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0777-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nSecurity issue fixed: \t  \n\n- CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause \n  segmentation fault to ntpd (bsc#1128525).\n\nOther issues addressed:\n\n- Fixed several bugs in the BANCOMM reclock driver.\n- Fixed ntp_loopfilter.c snprintf compilation warnings.\n- Fixed spurious initgroups() error message.\n- Fixed STA_NANO struct timex units.\n- Fixed GPS week rollover in libparse.\n- Fixed incorrect poll interval in packet.\n- Added a missing check for ENABLE_CMAC.\n","status":"published","published":"2019-03-27T11:23:40Z","modified":"2025-05-02T04:09:26.301558Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0789-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nSecurity issue fixed: \t  \n\n- CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause \n  segmentation fault to ntpd (bsc#1128525).\n\nOther isses addressed:\n\n- Fixed an issue which caused openSSL mismatch (bsc#1125401)\n- Fixed several bugs in the BANCOMM reclock driver.\n- Fixed ntp_loopfilter.c snprintf compilation warnings.\n- Fixed spurious initgroups() error message.\n- Fixed STA_NANO struct timex units.\n- Fixed GPS week rollover in libparse.\n- Fixed incorrect poll interval in packet.\n- Added a missing check for ENABLE_CMAC.\n","status":"published","published":"2019-03-28T10:56:58Z","modified":"2025-05-02T04:09:26.360505Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13991-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nSecurity issue fixed: \t  \n\n- CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause \n  segmentation fault to ntpd (bsc#1128525).\n\nOther issues addressed:\n\n- Make sure that SLE12 version is higher than the one in SLE11 (bsc#1001182). \n- Fixed several bugs in the BANCOMM reclock driver.\n- Fixed ntp_loopfilter.c snprintf compilation warnings.\n- Fixed spurious initgroups() error message.\n- Fixed STA_NANO struct timex units.\n- Fixed GPS week rollover in libparse.\n- Fixed incorrect poll interval in packet.\n- Added a missing check for ENABLE_CMAC.\n","status":"published","published":"2019-03-27T09:37:42Z","modified":"2026-02-04T04:05:40.464812Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:14004-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\t  \nSecurity issue fixed: \t  \n\n- CVE-2019-8936: Fixed a null pointer exception which could allow an authenticated attcker to cause \n  segmentation fault to ntpd (bsc#1128525).\n\nOther issues addressed:\n\n- Make sure that SLE12 version is higher than the one in SLE11 (bsc#1001182). \n- Fixed several bugs in the BANCOMM reclock driver.\n- Fixed ntp_loopfilter.c snprintf compilation warnings.\n- Fixed spurious initgroups() error message.\n- Fixed STA_NANO struct timex units.\n- Fixed GPS week rollover in libparse.\n- Fixed incorrect poll interval in packet.\n- Added a missing check for ENABLE_CMAC.\n","status":"published","published":"2019-04-01T11:59:24Z","modified":"2026-02-04T04:19:21.341385Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4563-1","title":"ntp vulnerability","description":"It was discovered that the fix for CVE-2018-7182 introduced a NULL pointer\ndereference into NTP. An attacker could use this vulnerability to cause a\ndenial of service (crash).\n","status":"published","published":"2020-10-01T21:04:43Z","modified":"2026-02-10T04:41:56Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4563-2","title":"ntp vulnerability","description":"USN-4563-1 fixed a vulnerability in NTP. This update provides the\ncorresponding update for Ubuntu 20.04 LTS and Ubuntu 20.10.\n\nOriginal advisory details:\n\n It was discovered that the fix for CVE-2018-7182 introduced a NULL pointer\n dereference into NTP. An attacker could use this vulnerability to cause a\n denial of service (crash).\n","status":"published","published":"2021-04-20T13:38:45Z","modified":"2026-02-10T04:41:56Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}