mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-ntpamazon-linux-ami-2-upgrade-ntp-debuginfoamazon-linux-ami-2-upgrade-ntp-docamazon-linux-ami-2-upgrade-ntp-perlamazon-linux-ami-2-upgrade-ntpdateamazon-linux-ami-2-upgrade-sntp | Jan 10, 2024 | Apr 11, 2023 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Apr 11, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-ntp | Jul 9, 2025 | Apr 11, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-ntp | Jul 18, 2023 | Apr 11, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-ntphuawei-euleros-2_0_sp11-upgrade-ntp-help | Jan 10, 2024 | Apr 11, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-ntp | Aug 9, 2023 | Apr 11, 2023 | |
| Ibm Aix | ibm-aix-ntp_advisory14 | Oct 6, 2023 | Apr 11, 2023 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Apr 11, 2023 | |
| Suse | — | suse-upgrade-ntpsuse-upgrade-ntp-doc | May 10, 2023 | Apr 11, 2023 |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Apr 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub