Total vulnerabilities in the database
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
| Software | From | Fixed in |
|---|---|---|
| ntp / ntp | 4.3.80 | 4.3.80.x |
| ntp / ntp | 4.3.51 | 4.3.51.x |
| ntp / ntp | 4.3.17 | 4.3.17.x |
| ntp / ntp | 4.3.30 | 4.3.30.x |
| ntp / ntp | 4.3.74 | 4.3.74.x |
| ntp / ntp | 4.3.67 | 4.3.67.x |
| ntp / ntp | 4.3.14 | 4.3.14.x |
| ntp / ntp | 4.3.27 | 4.3.27.x |
| ntp / ntp | 4.3.13 | 4.3.13.x |
| ntp / ntp | 4.3.36 | 4.3.36.x |
| ntp / ntp | 4.3.16 | 4.3.16.x |
| ntp / ntp | 4.3.35 | 4.3.35.x |
| ntp / ntp | 4.3.53 | 4.3.53.x |
| ntp / ntp | 4.3.64 | 4.3.64.x |
| ntp / ntp | 4.3.20 | 4.3.20.x |
| ntp / ntp | 4.3.40 | 4.3.40.x |
| ntp / ntp | 4.3.68 | 4.3.68.x |
| ntp / ntp | 4.3.46 | 4.3.46.x |
| ntp / ntp | 4.3.77 | 4.3.77.x |
| ntp / ntp | 4.3.1 | 4.3.1.x |
| ntp / ntp | 4.3.6 | 4.3.6.x |
| ntp / ntp | 4.3.2 | 4.3.2.x |
| ntp / ntp | 4.3.78 | 4.3.78.x |
| ntp / ntp | 4.3.79 | 4.3.79.x |
| ntp / ntp | 4.3.61 | 4.3.61.x |
| ntp / ntp | 4.3.42 | 4.3.42.x |
| ntp / ntp | 4.3.10 | 4.3.10.x |
| ntp / ntp | 4.3.88 | 4.3.88.x |
| ntp / ntp | 4.2.8-p9 | 4.2.8-p9.x |
| ntp / ntp | 4.3.69 | 4.3.69.x |
| ntp / ntp | 4.3.92 | 4.3.92.x |
| ntp / ntp | 4.3.65 | 4.3.65.x |
| ntp / ntp | 4.3.48 | 4.3.48.x |
| ntp / ntp | 4.3.71 | 4.3.71.x |
| ntp / ntp | 4.3.11 | 4.3.11.x |
| ntp / ntp | 4.3.34 | 4.3.34.x |
| ntp / ntp | 4.3.58 | 4.3.58.x |
| ntp / ntp | 4.3.31 | 4.3.31.x |
| ntp / ntp | 4.3.86 | 4.3.86.x |
| ntp / ntp | 4.3.85 | 4.3.85.x |
| ntp / ntp | 4.3.9 | 4.3.9.x |
| ntp / ntp | 4.3.57 | 4.3.57.x |
| ntp / ntp | 4.3.83 | 4.3.83.x |
| ntp / ntp | 4.3.93 | 4.3.93.x |
| ntp / ntp | 4.3.22 | 4.3.22.x |
| ntp / ntp | 4.3.56 | 4.3.56.x |
| ntp / ntp | 4.3.25 | 4.3.25.x |
| ntp / ntp | 4.3.91 | 4.3.91.x |
| ntp / ntp | 4.3.70 | 4.3.70.x |
| ntp / ntp | 4.3.59 | 4.3.59.x |
| ntp / ntp | 4.3.21 | 4.3.21.x |
| ntp / ntp | 4.3.39 | 4.3.39.x |
| ntp / ntp | 4.3.4 | 4.3.4.x |
| ntp / ntp | 4.3.49 | 4.3.49.x |
| ntp / ntp | 4.3.50 | 4.3.50.x |
| ntp / ntp | 4.3.60 | 4.3.60.x |
| ntp / ntp | 4.3.54 | 4.3.54.x |
| ntp / ntp | 4.3.15 | 4.3.15.x |
| ntp / ntp | 4.3.12 | 4.3.12.x |
| ntp / ntp | 4.3.90 | 4.3.90.x |
| ntp / ntp | 4.3.43 | 4.3.43.x |
| ntp / ntp | 4.3.45 | 4.3.45.x |
| ntp / ntp | 4.3.66 | 4.3.66.x |
| ntp / ntp | 4.3.0 | 4.3.0.x |
| ntp / ntp | 4.3.3 | 4.3.3.x |
| ntp / ntp | 4.3.81 | 4.3.81.x |
| ntp / ntp | 4.3.84 | 4.3.84.x |
| ntp / ntp | 4.3.24 | 4.3.24.x |
| ntp / ntp | 4.3.28 | 4.3.28.x |
| ntp / ntp | 4.3.18 | 4.3.18.x |
| ntp / ntp | 4.3.76 | 4.3.76.x |
| ntp / ntp | 4.3.33 | 4.3.33.x |
| ntp / ntp | 4.3.7 | 4.3.7.x |
| ntp / ntp | 4.3.38 | 4.3.38.x |
| ntp / ntp | 4.3.72 | 4.3.72.x |
| ntp / ntp | 4.3.87 | 4.3.87.x |
| ntp / ntp | 4.3.29 | 4.3.29.x |
| ntp / ntp | 4.3.23 | 4.3.23.x |
| ntp / ntp | 4.3.63 | 4.3.63.x |
| ntp / ntp | 4.3.52 | 4.3.52.x |
| ntp / ntp | 4.3.41 | 4.3.41.x |
| ntp / ntp | 4.3.47 | 4.3.47.x |
| ntp / ntp | 4.3.37 | 4.3.37.x |
| ntp / ntp | 4.3.73 | 4.3.73.x |
| ntp / ntp | 4.3.5 | 4.3.5.x |
| ntp / ntp | 4.3.82 | 4.3.82.x |
| ntp / ntp | 4.3.75 | 4.3.75.x |
| ntp / ntp | 4.3.32 | 4.3.32.x |
| ntp / ntp | 4.3.19 | 4.3.19.x |
| ntp / ntp | 4.3.44 | 4.3.44.x |
| ntp / ntp | 4.3.55 | 4.3.55.x |
| ntp / ntp | 4.3.26 | 4.3.26.x |
| ntp / ntp | 4.3.62 | 4.3.62.x |
| ntp / ntp | 4.3.8 | 4.3.8.x |
| ntp / ntp | 4.3.89 | 4.3.89.x |