1. CVE-Search
  2. CVE-2015-1822
ID CVE-2015-1822
Summary chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
References
Vulnerable Configurations
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.18:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.18:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.19:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.19:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.19.99.1:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.19.99.1:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.19.99.2:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.19.99.2:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.19.99.3:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.19.99.3:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.20:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.20:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.21:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.21:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.21:pre1:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.21:pre1:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.23:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.23:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.23:pre1:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.23:pre1:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.23.1:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.23.1:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.24:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.24:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.24:pre1:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.24:pre1:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.25:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.25:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.25:pre1:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.25:pre1:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.25:pre2:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.25:pre2:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.26:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.26:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.26:pre1:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.26:pre1:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.27:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.27:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.27:pre1:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.27:pre1:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.28:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.28:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.28:pre1:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.28:pre1:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.29:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.29:*:*:*:*:*:*:*
  • cpe:2.3:a:tuxfamily:chrony:1.31:*:*:*:*:*:*:*
    cpe:2.3:a:tuxfamily:chrony:1.31:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 13-02-2023 - 00:47)
Impact:
Exploitability:
CWE CWE-17
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
redhat via4
rpms
  • chrony-0:2.1.1-1.el7
  • chrony-debuginfo-0:2.1.1-1.el7
refmap via4
bid 73956
confirm http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
debian DSA-3222
gentoo GLSA-201507-01
mlist [chrony-announce] 20150407 chrony-1.31.1 released (security)
Last major update 13-02-2023 - 00:47
Published 16-04-2015 - 14:59
Last modified 13-02-2023 - 00:47
Back to Top