CVE-2015-5146

ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.

• CWE-20

• http://bugs.ntp.org/show_bug.cgi?id=2853Issue Tracking, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.htmlThird Party Advisory
• http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_SecuVendor Advisory
• http://www.debian.org/security/2015/dsa-3388Third Party Advisory
• http://www.securityfocus.com/bid/75589Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1034168Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1238136Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201509-01Mitigation, Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20180731-0003/
• http://bugs.ntp.org/show_bug.cgi?id=2853Issue Tracking, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.htmlThird Party Advisory
• http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_SecuVendor Advisory
• http://www.debian.org/security/2015/dsa-3388Third Party Advisory
• http://www.securityfocus.com/bid/75589Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1034168Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1238136Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/201509-01Mitigation, Third Party Advisory, VDB Entry
• https://security.netapp.com/advisory/ntap-20180731-0003/

Published

Aug 24, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5132Buffer overflow in Adobe Flash Player before 18.0.0.232 on W…
• CVE-2015-5133Buffer overflow in Adobe Flash Player before 18.0.0.232 on W…
• CVE-2015-5134Use-after-free vulnerability in Adobe Flash Player before 18…
• CVE-2015-5143The session backends in Django before 1.4.21, 1.5.x through …
• CVE-2015-5144Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.…
• CVE-2015-5145validators.URLValidator in Django 1.8.x before 1.8.3 allows …
• CVE-2015-5147Stack-based buffer overflow in the header_anchor function in…
• CVE-2015-5148SQL injection vulnerability in LivelyCart 1.2.0 allows remot…
• CVE-2015-5149Directory traversal vulnerability in Zoho ManageEngine Suppo…
• CVE-2015-5150Multiple cross-site scripting (XSS) vulnerabilities in Zoho …
• CVE-2015-5151Cross-site scripting (XSS) vulnerability in the Slider Revol…
• CVE-2015-5152Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTT…