chrony: multiple vulnerabilities
| Package(s): | chrony | CVE #(s): | CVE-2015-1821 CVE-2015-1822 CVE-2015-1853 | ||||||||||||||||||||||||||||||||||||
| Created: | April 13, 2015 | Updated: | December 22, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
CVE-2015-1821: Using particular address/subnet pairs when configuring access control would cause an invalid memory write. This could allow attackers to cause a denial of service (crash) or execute arbitrary code. CVE-2015-1822: When allocating memory to save unacknowledged replies to authenticated command requests, a pointer would be left uninitialized, which could trigger an invalid memory write. This could allow attackers to cause a denial of service (crash) or execute arbitrary code. CVE-2015-1853: When peering with other NTP hosts using authenticated symmetric association, the internal state variables would be updated before the MAC of the NTP messages was validated. This could allow a remote attacker to cause a denial of service by impeding synchronization between NTP peers. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
Posted Apr 30, 2015 20:53 UTC (Thu)
by toyotabedzrock (guest, #88005)
[Link]
chrony: multiple vulnerabilities