Vulnerability from csaf_suse
Published
2016-04-28 13:46
Modified
2016-04-28 13:46
Summary
Security update for ntp
Notes
Title of the patch
Security update for ntp
Description of the patch
ntp was updated to version 4.2.8p6 to fix 12 security issues.
These security issues were fixed:
- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).
- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).
- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).
- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).
- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).
- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).
- CVE-2015-7975: nextvar() missing length check (bsc#962988).
- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).
- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).
- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).
- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).
- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).
These non-security issues were fixed:
- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP
(--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added
the authreg directive.
- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.
When run as cron job, /usr/sbin/ is not in the path, which caused
the synchronization to fail.
- bsc#782060: Speedup ntpq.
- bsc#916617: Add /var/db/ntp-kod.
- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.
- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.
- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.
- bsc#784760: Remove local clock from default configuration
Patchnames
slessp4-ntp-12533
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for ntp", title: "Title of the patch", }, { category: "description", text: "ntp was updated to version 4.2.8p6 to fix 12 security issues.\n\nThese security issues were fixed:\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP\n (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added\n the authreg directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n When run as cron job, /usr/sbin/ is not in the path, which caused\n the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- bsc#784760: Remove local clock from default configuration\n", title: "Description of the patch", }, { category: "details", text: "slessp4-ntp-12533", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_1175-1.json", }, { category: "self", summary: "URL for SUSE-SU-2016:1175-1", url: "https://www.suse.com/support/update/announcement/2016/suse-su-20161175-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2016:1175-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2016-April/002032.html", }, { category: "self", summary: "SUSE Bug 782060", url: "https://bugzilla.suse.com/782060", }, { category: "self", summary: "SUSE Bug 784760", url: "https://bugzilla.suse.com/784760", }, { category: "self", summary: "SUSE Bug 916617", url: "https://bugzilla.suse.com/916617", }, { category: "self", summary: "SUSE Bug 951559", url: "https://bugzilla.suse.com/951559", }, { category: "self", summary: "SUSE Bug 951629", url: "https://bugzilla.suse.com/951629", }, { category: "self", summary: "SUSE Bug 956773", url: "https://bugzilla.suse.com/956773", }, { category: "self", summary: "SUSE Bug 962318", url: "https://bugzilla.suse.com/962318", }, { category: "self", summary: "SUSE Bug 962784", url: "https://bugzilla.suse.com/962784", }, { category: "self", summary: "SUSE Bug 962802", url: "https://bugzilla.suse.com/962802", }, { category: "self", summary: "SUSE Bug 962960", url: "https://bugzilla.suse.com/962960", }, { category: "self", summary: "SUSE Bug 962966", url: "https://bugzilla.suse.com/962966", }, { category: "self", summary: "SUSE Bug 962970", url: "https://bugzilla.suse.com/962970", }, { category: "self", summary: "SUSE Bug 962988", url: "https://bugzilla.suse.com/962988", }, { category: "self", summary: "SUSE Bug 962994", url: "https://bugzilla.suse.com/962994", }, { category: "self", summary: "SUSE Bug 962995", url: "https://bugzilla.suse.com/962995", }, { category: "self", summary: "SUSE Bug 962997", url: "https://bugzilla.suse.com/962997", }, { category: "self", summary: "SUSE Bug 963000", url: "https://bugzilla.suse.com/963000", }, { category: "self", summary: "SUSE Bug 963002", url: "https://bugzilla.suse.com/963002", }, { category: "self", summary: "SUSE Bug 975496", url: "https://bugzilla.suse.com/975496", }, { category: "self", summary: "SUSE Bug 975981", url: "https://bugzilla.suse.com/975981", }, { category: "self", summary: "SUSE CVE CVE-2015-5300 page", url: "https://www.suse.com/security/cve/CVE-2015-5300/", }, { category: "self", summary: "SUSE CVE CVE-2015-7973 page", url: "https://www.suse.com/security/cve/CVE-2015-7973/", }, { category: "self", summary: "SUSE CVE CVE-2015-7974 page", url: "https://www.suse.com/security/cve/CVE-2015-7974/", }, { category: "self", summary: "SUSE CVE CVE-2015-7975 page", url: "https://www.suse.com/security/cve/CVE-2015-7975/", }, { category: "self", summary: "SUSE CVE CVE-2015-7976 page", url: "https://www.suse.com/security/cve/CVE-2015-7976/", }, { category: "self", summary: "SUSE CVE CVE-2015-7977 page", url: "https://www.suse.com/security/cve/CVE-2015-7977/", }, { category: "self", summary: "SUSE CVE CVE-2015-7978 page", url: "https://www.suse.com/security/cve/CVE-2015-7978/", }, { category: "self", summary: "SUSE CVE CVE-2015-7979 page", url: "https://www.suse.com/security/cve/CVE-2015-7979/", }, { category: "self", summary: "SUSE CVE CVE-2015-8138 page", url: "https://www.suse.com/security/cve/CVE-2015-8138/", }, { category: "self", summary: "SUSE CVE CVE-2015-8139 page", url: "https://www.suse.com/security/cve/CVE-2015-8139/", }, { category: "self", summary: "SUSE CVE CVE-2015-8140 page", url: "https://www.suse.com/security/cve/CVE-2015-8140/", }, { category: "self", summary: "SUSE CVE CVE-2015-8158 page", url: "https://www.suse.com/security/cve/CVE-2015-8158/", }, ], title: "Security update for ntp", tracking: { current_release_date: "2016-04-28T13:46:02Z", generator: { date: "2016-04-28T13:46:02Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2016:1175-1", initial_release_date: "2016-04-28T13:46:02Z", revision_history: [ { date: "2016-04-28T13:46:02Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "ntp-4.2.8p6-8.2.i586", product: { name: "ntp-4.2.8p6-8.2.i586", product_id: "ntp-4.2.8p6-8.2.i586", }, }, { category: "product_version", name: "ntp-doc-4.2.8p6-8.2.i586", product: { name: "ntp-doc-4.2.8p6-8.2.i586", product_id: "ntp-doc-4.2.8p6-8.2.i586", }, }, ], category: "architecture", name: "i586", }, { branches: [ { category: "product_version", name: "ntp-4.2.8p6-8.2.ia64", product: { name: "ntp-4.2.8p6-8.2.ia64", product_id: "ntp-4.2.8p6-8.2.ia64", }, }, { category: "product_version", name: "ntp-doc-4.2.8p6-8.2.ia64", product: { name: "ntp-doc-4.2.8p6-8.2.ia64", product_id: "ntp-doc-4.2.8p6-8.2.ia64", }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "ntp-4.2.8p6-8.2.ppc64", product: { name: "ntp-4.2.8p6-8.2.ppc64", product_id: "ntp-4.2.8p6-8.2.ppc64", }, }, { category: "product_version", name: "ntp-doc-4.2.8p6-8.2.ppc64", product: { name: "ntp-doc-4.2.8p6-8.2.ppc64", product_id: "ntp-doc-4.2.8p6-8.2.ppc64", }, }, ], category: "architecture", name: "ppc64", }, { branches: [ { category: "product_version", name: "ntp-4.2.8p6-8.2.s390x", product: { name: "ntp-4.2.8p6-8.2.s390x", product_id: "ntp-4.2.8p6-8.2.s390x", }, }, { category: "product_version", name: "ntp-doc-4.2.8p6-8.2.s390x", product: { name: "ntp-doc-4.2.8p6-8.2.s390x", product_id: "ntp-doc-4.2.8p6-8.2.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "ntp-4.2.8p6-8.2.x86_64", product: { name: "ntp-4.2.8p6-8.2.x86_64", product_id: "ntp-4.2.8p6-8.2.x86_64", }, }, { category: "product_version", name: "ntp-doc-4.2.8p6-8.2.x86_64", product: { name: "ntp-doc-4.2.8p6-8.2.x86_64", product_id: "ntp-doc-4.2.8p6-8.2.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Server 11 SP4", product: { name: "SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4", product_identification_helper: { cpe: "cpe:/o:suse:suse_sles:11:sp4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product: { name: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:11:sp4", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.i586 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", }, product_reference: "ntp-4.2.8p6-8.2.i586", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.ia64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", }, product_reference: "ntp-4.2.8p6-8.2.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", }, product_reference: "ntp-4.2.8p6-8.2.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.s390x as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", }, product_reference: "ntp-4.2.8p6-8.2.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", }, product_reference: "ntp-4.2.8p6-8.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.i586 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", }, product_reference: "ntp-doc-4.2.8p6-8.2.i586", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.ia64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", }, product_reference: "ntp-doc-4.2.8p6-8.2.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.ppc64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", }, product_reference: "ntp-doc-4.2.8p6-8.2.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.s390x as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", }, product_reference: "ntp-doc-4.2.8p6-8.2.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.x86_64 as component of SUSE Linux Enterprise Server 11 SP4", product_id: "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", }, product_reference: "ntp-doc-4.2.8p6-8.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", }, product_reference: "ntp-4.2.8p6-8.2.i586", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", }, product_reference: "ntp-4.2.8p6-8.2.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", }, product_reference: "ntp-4.2.8p6-8.2.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", }, product_reference: "ntp-4.2.8p6-8.2.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-4.2.8p6-8.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", }, product_reference: "ntp-4.2.8p6-8.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", }, product_reference: "ntp-doc-4.2.8p6-8.2.i586", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", }, product_reference: "ntp-doc-4.2.8p6-8.2.ia64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", }, product_reference: "ntp-doc-4.2.8p6-8.2.ppc64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", }, product_reference: "ntp-doc-4.2.8p6-8.2.s390x", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, { category: "default_component_of", full_product_name: { name: "ntp-doc-4.2.8p6-8.2.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", }, product_reference: "ntp-doc-4.2.8p6-8.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 11 SP4", }, ], }, vulnerabilities: [ { cve: "CVE-2015-5300", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5300", }, ], notes: [ { category: "general", text: "The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5300", url: "https://www.suse.com/security/cve/CVE-2015-5300", }, { category: "external", summary: "SUSE Bug 951629 for CVE-2015-5300", url: "https://bugzilla.suse.com/951629", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-5300", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962624 for CVE-2015-5300", url: "https://bugzilla.suse.com/962624", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-5300", }, { cve: "CVE-2015-7973", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-7973", }, ], notes: [ { category: "general", text: "NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-7973", url: "https://www.suse.com/security/cve/CVE-2015-7973", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-7973", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962995 for CVE-2015-7973", url: "https://bugzilla.suse.com/962995", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-7973", }, { cve: "CVE-2015-7974", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-7974", }, ], notes: [ { category: "general", text: "NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a \"skeleton key.\"", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-7974", url: "https://www.suse.com/security/cve/CVE-2015-7974", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-7974", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962960 for CVE-2015-7974", url: "https://bugzilla.suse.com/962960", }, { category: "external", summary: "SUSE Bug 962995 for CVE-2015-7974", url: "https://bugzilla.suse.com/962995", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.7, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "low", }, ], title: "CVE-2015-7974", }, { cve: "CVE-2015-7975", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-7975", }, ], notes: [ { category: "general", text: "The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application crash).", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-7975", url: "https://www.suse.com/security/cve/CVE-2015-7975", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-7975", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962988 for CVE-2015-7975", url: "https://bugzilla.suse.com/962988", }, { category: "external", summary: "SUSE Bug 962995 for CVE-2015-7975", url: "https://bugzilla.suse.com/962995", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "low", }, ], title: "CVE-2015-7975", }, { cve: "CVE-2015-7976", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-7976", }, ], notes: [ { category: "general", text: "The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-7976", url: "https://www.suse.com/security/cve/CVE-2015-7976", }, { category: "external", summary: "SUSE Bug 962802 for CVE-2015-7976", url: "https://bugzilla.suse.com/962802", }, { category: "external", summary: "SUSE Bug 962995 for CVE-2015-7976", url: "https://bugzilla.suse.com/962995", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "low", }, ], title: "CVE-2015-7976", }, { cve: "CVE-2015-7977", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-7977", }, ], notes: [ { category: "general", text: "ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-7977", url: "https://www.suse.com/security/cve/CVE-2015-7977", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-7977", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962970 for CVE-2015-7977", url: "https://bugzilla.suse.com/962970", }, { category: "external", summary: "SUSE Bug 962995 for CVE-2015-7977", url: "https://bugzilla.suse.com/962995", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-7977", }, { cve: "CVE-2015-7978", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-7978", }, ], notes: [ { category: "general", text: "NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-7978", url: "https://www.suse.com/security/cve/CVE-2015-7978", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-7978", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962970 for CVE-2015-7978", url: "https://bugzilla.suse.com/962970", }, { category: "external", summary: "SUSE Bug 962995 for CVE-2015-7978", url: "https://bugzilla.suse.com/962995", }, { category: "external", summary: "SUSE Bug 963000 for CVE-2015-7978", url: "https://bugzilla.suse.com/963000", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-7978", }, { cve: "CVE-2015-7979", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-7979", }, ], notes: [ { category: "general", text: "NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-7979", url: "https://www.suse.com/security/cve/CVE-2015-7979", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-7979", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962784 for CVE-2015-7979", url: "https://bugzilla.suse.com/962784", }, { category: "external", summary: "SUSE Bug 962995 for CVE-2015-7979", url: "https://bugzilla.suse.com/962995", }, { category: "external", summary: "SUSE Bug 977459 for CVE-2015-7979", url: "https://bugzilla.suse.com/977459", }, { category: "external", summary: "SUSE Bug 982065 for CVE-2015-7979", url: "https://bugzilla.suse.com/982065", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-7979", }, { cve: "CVE-2015-8138", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-8138", }, ], notes: [ { category: "general", text: "NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-8138", url: "https://www.suse.com/security/cve/CVE-2015-8138", }, { category: "external", summary: "SUSE Bug 951608 for CVE-2015-8138", url: "https://bugzilla.suse.com/951608", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-8138", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 963002 for CVE-2015-8138", url: "https://bugzilla.suse.com/963002", }, { category: "external", summary: "SUSE Bug 974668 for CVE-2015-8138", url: "https://bugzilla.suse.com/974668", }, { category: "external", summary: "SUSE Bug 977446 for CVE-2015-8138", url: "https://bugzilla.suse.com/977446", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-8138", }, { cve: "CVE-2015-8139", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-8139", }, ], notes: [ { category: "general", text: "ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-8139", url: "https://www.suse.com/security/cve/CVE-2015-8139", }, { category: "external", summary: "SUSE Bug 1010964 for CVE-2015-8139", url: "https://bugzilla.suse.com/1010964", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-8139", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962997 for CVE-2015-8139", url: "https://bugzilla.suse.com/962997", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-8139", }, { cve: "CVE-2015-8140", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-8140", }, ], notes: [ { category: "general", text: "The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-8140", url: "https://www.suse.com/security/cve/CVE-2015-8140", }, { category: "external", summary: "SUSE Bug 1010964 for CVE-2015-8140", url: "https://bugzilla.suse.com/1010964", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-8140", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962994 for CVE-2015-8140", url: "https://bugzilla.suse.com/962994", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "moderate", }, ], title: "CVE-2015-8140", }, { cve: "CVE-2015-8158", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-8158", }, ], notes: [ { category: "general", text: "The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-8158", url: "https://www.suse.com/security/cve/CVE-2015-8158", }, { category: "external", summary: "SUSE Bug 959243 for CVE-2015-8158", url: "https://bugzilla.suse.com/959243", }, { category: "external", summary: "SUSE Bug 962966 for CVE-2015-8158", url: "https://bugzilla.suse.com/962966", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p6-8.2.x86_64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.i586", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ia64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.ppc64", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.s390x", "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p6-8.2.x86_64", ], }, ], threats: [ { category: "impact", date: "2016-04-28T13:46:02Z", details: "low", }, ], title: "CVE-2015-8158", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.