Summary
[4.2.6p5-29.0.1]
- Bump release to avoid ULN conflict with Oracle modified errata.
[4.2.6p5-29]
- fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
- fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
- fix crash in parsing of received address in ntpq (#1616250)
- avoid reading freed memory after disabling netlink socket (#1555401)
- dont disable netlink socket on ENOBUFS error (#1555413)
- replace ntpstat with shell script using ntpq and supporting chrony (#1592871)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ntp | 0:4.2.6p5-29.0.1.el7 |
| Oracle Linux · 7 | ntp-doc | 0:4.2.6p5-29.0.1.el7 |
| Oracle Linux · 7 | ntp-perl | 0:4.2.6p5-29.0.1.el7 |
| Oracle Linux · 7 | ntpdate | 0:4.2.6p5-29.0.1.el7 |
| Oracle Linux · 7 | sntp | 0:4.2.6p5-29.0.1.el7 |
Vulnerabilities 1
-
Unscored —
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or e…