CVE-2015-7692

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-0780.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2583.htmlThird Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug2899Vendor Advisory
http://www.debian.org/security/2015/dsa-3388Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
http://www.securityfocus.com/bid/77285Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033951Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1274254Issue Tracking, Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201607-15Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20171004-0001/Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0780.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2583.htmlThird Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug2899Vendor Advisory
http://www.debian.org/security/2015/dsa-3388Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlThird Party Advisory
http://www.securityfocus.com/bid/77285Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033951Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1274254Issue Tracking, Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201607-15Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20171004-0001/Third Party Advisory

Timeline

Published: Aug 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-76959.8The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitr CVE-2015-76966.8Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly exec CVE-2015-76974.3Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.CVE-2015-76989.0icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argume CVE-2015-76999.0The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to inst CVE-2015-77009.8Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via un CVE-2015-77017.5Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a den CVE-2015-77026.5The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (CVE-2015-77037.5The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote c CVE-2015-77047.5The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of craft CVE-2015-77059.8The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large n CVE-2015-77066.1Multiple cross-site scripting (XSS) vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web