mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ntp-debuginfoUpgrade sntpUpgrade ntp-perlUpgrade ntpdateUpgrade ntpUpgrade ntp-doc | Jan 10, 2024 | Apr 11, 2023 |
| Debian | — | No solution exists | May 15, 2025 | Apr 11, 2023 |
| Gentoo Linux | — | Upgrade net-misc/ntp. | Jul 9, 2025 | Apr 11, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ntp | Jul 18, 2023 | Apr 11, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ntp-helpUpgrade ntp | Jan 10, 2024 | Apr 11, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ntp | Aug 9, 2023 | Apr 11, 2023 |
| Ibm Aix | — | Apply the fix or workaround for ntp_advisory14 | Oct 6, 2023 | Apr 11, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 11, 2023 |
| Suse | — | Upgrade ntpUpgrade ntp-doc | May 10, 2023 | Apr 11, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub