VIR Vulnerability Intelligence Relay

CVE-2015-7978

high
Published 2017-01-30 · Modified 2026-05-13
CVSS v3
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
VIR risk
7.5

Description

NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.

Predictions

Exploit likelihood
83%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

OS impact
OSVersionStatusFixed in
debian debianbullseyefixed1:4.2.8p7+dfsg-1

Application impact
VendorProductVersionsFixed
ntpntp{"endIncluding":"4.2.8"}
ntpntp4.3.0
ntpntp4.3.1
ntpntp4.3.2
ntpntp4.3.3
ntpntp4.3.4
ntpntp4.3.5
ntpntp4.3.6
ntpntp4.3.7
ntpntp4.3.8
ntpntp4.3.10
ntpntp4.3.11
ntpntp4.3.12
ntpntp4.3.13
ntpntp4.3.14
ntpntp4.3.15
ntpntp4.3.16
ntpntp4.3.17
ntpntp4.3.18
ntpntp4.3.19
ntpntp4.3.20
ntpntp4.3.21
ntpntp4.3.22
ntpntp4.3.23
ntpntp4.3.24
ntpntp4.3.25
ntpntp4.3.26
ntpntp4.3.27
ntpntp4.3.28
ntpntp4.3.29
ntpntp4.3.30
ntpntp4.3.31
ntpntp4.3.32
ntpntp4.3.33
ntpntp4.3.34
ntpntp4.3.35
ntpntp4.3.36
ntpntp4.3.37
ntpntp4.3.38
ntpntp4.3.39
ntpntp4.3.40
ntpntp4.3.41
ntpntp4.3.42
ntpntp4.3.43
ntpntp4.3.44
ntpntp4.3.45
ntpntp4.3.46
ntpntp4.3.47
ntpntp4.3.48
ntpntp4.3.49
ntpntp4.3.50
ntpntp4.3.51
ntpntp4.3.52
ntpntp4.3.53
ntpntp4.3.54
ntpntp4.3.55
ntpntp4.3.56
ntpntp4.3.57
ntpntp4.3.58
ntpntp4.3.59
ntpntp4.3.60
ntpntp4.3.61
ntpntp4.3.62
ntpntp4.3.63
ntpntp4.3.64
ntpntp4.3.65
ntpntp4.3.66
ntpntp4.3.67
ntpntp4.3.68
ntpntp4.3.69
ntpntp4.3.70
ntpntp4.3.71
ntpntp4.3.72
ntpntp4.3.73
ntpntp4.3.74
ntpntp4.3.75
ntpntp4.3.76
ntpntp4.3.77
ntpntp4.3.78
ntpntp4.3.79
ntpntp4.3.80
ntpntp4.3.81
ntpntp4.3.82
ntpntp4.3.83
ntpntp4.3.84
ntpntp4.3.85
ntpntp4.3.86
ntpntp4.3.87
ntpntp4.3.88
ntpntp4.3.89

References

CWEs

CWE-400

💬 Discuss CVE-2015-7978 on VIR Community →

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.