{"id":"CVE-2023-26554","aliases":["DEBIAN-CVE-2023-26554","EUVD-2023-30351","GHSA-p43r-r5fw-2w5x","OESA-2023-1282","SUSE-SU-2023:2142-1","SUSE-SU-2023:2171-1","UBUNTU-CVE-2023-26554"],"status":"published","title":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character.","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0064,"percentile":0.50997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2023-04-11T00:00:00Z","modified":"2026-08-27T23:04:38Z","affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.8p15+dfsg-1","1:4.2.8p15+dfsg-2-hurd.1","1:4.2.8p15+dfsg-2~1.2.1+dfsg1-7+hurd.1","1:4.2.8p15+dfsg-2~1.2.1+dfsg1-8+hurd.1","1:4.2.8p15+dfsg-2~1.2.2+dfsg1-2+hurd.1","1:4.2.8p15+dfsg-2~hurd.1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p14-7.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p14-7.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-9.oe2203sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-9.oe2203sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-150000.4.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-150000.4.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-100.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-100.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","1:4.2.6.p5+dfsg-3ubuntu2.14.04.10","1:4.2.6.p5+dfsg-3ubuntu2.14.04.11","1:4.2.6.p5+dfsg-3ubuntu2.14.04.12","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2","1:4.2.8p4+dfsg-3ubuntu5.3","1:4.2.8p4+dfsg-3ubuntu5.4","1:4.2.8p4+dfsg-3ubuntu5.5","1:4.2.8p4+dfsg-3ubuntu5.6","1:4.2.8p4+dfsg-3ubuntu5.7","1:4.2.8p4+dfsg-3ubuntu5.8","1:4.2.8p4+dfsg-3ubuntu5.9","1:4.2.8p4+dfsg-3ubuntu5.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.8p10+dfsg-5ubuntu3","1:4.2.8p10+dfsg-5ubuntu4","1:4.2.8p10+dfsg-5ubuntu5","1:4.2.8p10+dfsg-5ubuntu6","1:4.2.8p10+dfsg-5ubuntu7","1:4.2.8p10+dfsg-5ubuntu7.1","1:4.2.8p10+dfsg-5ubuntu7.1+esm1","1:4.2.8p10+dfsg-5ubuntu7.1+esm2","1:4.2.8p10+dfsg-5ubuntu7.2","1:4.2.8p10+dfsg-5ubuntu7.2+esm1","1:4.2.8p10+dfsg-5ubuntu7.3","1:4.2.8p10+dfsg-5ubuntu7.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.8p12+dfsg-3ubuntu2","1:4.2.8p12+dfsg-3ubuntu3","1:4.2.8p12+dfsg-3ubuntu4","1:4.2.8p12+dfsg-3ubuntu4.20.04.1","1:4.2.8p12+dfsg-3ubuntu4.20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.8p12+dfsg-3ubuntu6","1:4.2.8p15+dfsg-1ubuntu1","1:4.2.8p15+dfsg-1ubuntu2"]}],"products":[{"vendor":"ntp","product":"ntp"}],"references":[{"url":"https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26554","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26554","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p43r-r5fw-2w5x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26554","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26553","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26552","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232142-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210386","tags":["report"]},{"url":"https://bugzilla.suse.com/1210387","tags":["report"]},{"url":"https://bugzilla.suse.com/1210388","tags":["report"]},{"url":"https://bugzilla.suse.com/1210389","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26554","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232171-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-26554","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26554","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-26554","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.","status":"published","published":"2023-04-11T00:00:00Z","modified":"2025-02-11T15:26:14.067Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-30351","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.","status":"published","published":"2023-04-11T00:00:00Z","modified":"2025-02-11T15:26:14Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:03:59.807436Z"}],"ghsa":[{"id":"GHSA-p43r-r5fw-2w5x","title":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character.","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character.","status":"published","published":"2023-04-11T21:31:01Z","modified":"2024-04-04T03:24:48Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:56:14.876837Z"}],"nvd":[{"id":"CVE-2023-26554","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.","status":"published","published":"2023-04-11T21:15:21.777Z","modified":"2026-06-17T05:43:34.93Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-26554","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.","status":"published","published":"2023-04-11T21:15:21.777Z","modified":"2026-03-14T12:03:08.832985Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-26554","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.","status":"published","published":"2023-04-11T21:15:21.777Z","modified":"2026-08-27T23:04:38.290817509Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"OESA-2023-1282","title":"ntp security update","description":"NTP is a protocol designed to synchronize the clocks of computers over a network, NTP version 4, a significant revision of the previous NTP standard, is the current development version. It is formalized by RFCs released by the IETF.\r\n\r\nSecurity Fix(es):\r\n\r\nmstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp\u0026lt;cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26551)\r\n\r\nmstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a \u0026apos;\\0\u0026apos; character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26554)\r\n\r\nmstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26553)\r\n\r\nmstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.(CVE-2023-26552)","status":"published","published":"2023-05-19T11:05:45Z","modified":"2026-08-18T01:17:40.646875786Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2023-26554","description":"mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.","status":"published","published":"2023-04-11T21:15:00Z","modified":"2025-10-24T05:01:51Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"SUSE-SU-2023:2142-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nFixed multiple out of bound writes:\nCVE-2023-26551 (bsc#1210386), CVE-2023-26552 (bsc#1210388), CVE-2023-26553 (bsc#1210387), CVE-2023-26554 (bsc#1210389).\n","status":"published","published":"2023-05-09T12:36:06Z","modified":"2026-02-04T04:26:01.624759Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2171-1","title":"Security update for ntp","description":"This update for ntp fixes the following issues:\n\nFixed multiple out of bound writes:\n\nCVE-2023-26551 (bsc#1210386), CVE-2023-26552 (bsc#1210388), CVE-2023-26553 (bsc#1210387), CVE-2023-26554 (bsc#1210389).\n","status":"published","published":"2023-05-11T07:51:50Z","modified":"2026-02-04T04:21:41.674553Z","updated_at":"2026-11-02T15:53:52.350754Z"}]}}