CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2015-5219
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
Severity
- EPSS
- 6.1% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-704
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- fedoraproject:fedora
- novell:leap
- ntp:ntp
- opensuse:leap
- oracle:linux
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_hpc_node
- redhat:enterprise_linux_server
- redhat:enterprise_linux_workstation
- siemens:tim_4r-id_dnp3_firmware
- siemens:tim_4r-ie_firmware
- suse:linux_enterprise_debuginfo
- suse:linux_enterprise_server
- suse:manager
- suse:manager_proxy
- suse:openstack_cloud
References
- http://aix.software.ibm.com/aix/efixes/security/ntp_advisory4.asc
- http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=51786731Gr4-NOrTBC_a_uXO4wuGhg
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.html