PatchTheCVEntp vulnerabilities and fixes
Recent CVEs affecting ntp, with upgrade or downgrade steps. 5 tracked.
ntp has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-04-11. Highest priority: CVE-2023-26553 (score 38/100).
- CVE-2023-26555 MEDIUM 6.4 DOWNGRADE praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write
- CVE-2023-26554 MEDIUM 5.6 DOWNGRADE mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character
- CVE-2023-26553 MEDIUM 5.6 DOWNGRADE mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number
- CVE-2023-26552 MEDIUM 5.6 DOWNGRADE mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point
- CVE-2023-26551 MEDIUM 5.6 DOWNGRADE mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop
FAQ
How do I fix ntp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ntp being exploited right now?
None of the tracked ntp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ntp CVE should I patch first?
CVE-2023-26553 currently ranks highest (38/100): mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.