Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691, CVE-2015-7852, CVE-2015-7701 ---- Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-77bfbc1bcd 2015-11-04 18:17:28.541358 -------------------------------------------------------------------------------- Name : ntp Product : Fedora 21 Version : 4.2.6p5 Release : 34.fc21 URL : http://www.ntp.org Summary : The NTP daemon and utilities Description : The Network Time Protocol (NTP) is used to synchronize a computer's time with another reference time source. This package includes ntpd (a daemon which continuously adjusts system time) and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl package, ntpdate is in the ntpdate package and sntp is in the sntp package. The documentation is in the ntp-doc package. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691, CVE-2015-7852, CVE-2015-7701 ---- Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1274254 - CVE-2015-7691 CVE-2015-7692 CVE-2015-7702 ntp: incomplete checks in ntp_crypto.c https://bugzilla.redhat.com/show_bug.cgi?id=1274254 [ 2 ] Bug #1274255 - CVE-2015-7701 ntp: slow memory leak in CRYPTO_ASSOC https://bugzilla.redhat.com/show_bug.cgi?id=1274255 [ 3 ] Bug #1274261 - CVE-2015-7852 ntp: ntpq atoascii memory corruption vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=1274261 [ 4 ] Bug #1274265 - CVE-2015-7871 ntp: crypto-NAK symmetric association authentication bypassvulnerability https://bugzilla.redhat.com/show_bug.cgi?id=1274265 [ 5 ] Bug #1271070 - CVE-2015-7704 ntp: disabling synchronization via crafted KoD packet https://bugzilla.redhat.com/show_bug.cgi?id=1271070 [ 6 ] Bug #1271076 - CVE-2015-5300 ntp: MITM attacker can force ntpd to make a step larger than the panic threshold https://bugzilla.redhat.com/show_bug.cgi?id=1271076 [ 7 ] Bug #1238136 - CVE-2015-5146 ntp: ntpd control message crash on crafted NUL-byte in configuration directive (VU#668167) https://bugzilla.redhat.com/show_bug.cgi?id=1238136 [ 8 ] Bug #1254542 - CVE-2015-5194 ntp: crash with crafted logconfig configuration command https://bugzilla.redhat.com/show_bug.cgi?id=1254542 [ 9 ] Bug #1254544 - CVE-2015-5195 ntp: ntpd crash when processing config commands with statistics type https://bugzilla.redhat.com/show_bug.cgi?id=1254544 [ 10 ] Bug #1254547 - CVE-2015-7703 ntp: config command can be used to set the pidfile and drift file paths https://bugzilla.redhat.com/show_bug.cgi?id=1254547 [ 11 ] Bug #1255118 - CVE-2015-5219 ntp: infinite loop in sntp processing crafted packet https://bugzilla.redhat.com/show_bug.cgi?id=1255118 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ntp' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691, CVE-2015-7852, CVE-2015-7701. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-f5f5ec7b6b 2015-11-02 17:42:58.181594 -------------------------------------------------------------------------------- Name : ntp Product : Fedora 23 Version : 4.2.6p5 Release : 34.fc23 URL : http://www.ntp.org Summary : The NTP daemon and utilities Description : The Network Time Protocol (NTP) is used to synchronize a computer's time with another reference time source. This package includes ntpd (a daemon which continuously adjusts system time) and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl package, ntpdate is in the ntpdate package and sntp is in the sntp package. The documentation is in the ntp-doc package. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691, CVE-2015-7852, CVE-2015-7701 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1274254 - CVE-2015-7691 CVE-2015-7692 CVE-2015-7702 ntp: incomplete checks in ntp_crypto.c https://bugzilla.redhat.com/show_bug.cgi?id=1274254 [ 2 ] Bug #1274255 - CVE-2015-7701 ntp: slow memory leak in CRYPTO_ASSOC https://bugzilla.redhat.com/show_bug.cgi?id=1274255 [ 3 ] Bug #1274261 - CVE-2015-7852 ntp: ntpq atoascii memory corruption vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=1274261 [ 4 ] Bug #1274265 - CVE-2015-7871 ntp: crypto-NAK symmetric association authentication bypass vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=1274265 [ 5 ] Bug #1271070 - CVE-2015-7704 ntp: disabling synchronization via crafted KoD packet https://bugzilla.redhat.com/show_bug.cgi?id=1271070 [ 6 ] Bug #1271076 - CVE-2015-5300 ntp: MITM attacker can force ntpd to make a step larger than the panic threshold https://bugzilla.redhat.com/show_bug.cgi?id=1271076 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ntp' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
This update includes an updated libtool script to synchronize with the gcc 4.0.1 update.. ---------------------------------------------------------------------Fedora Update Notification FEDORA-2005-636 2005-07-27 ---------------------------------------------------------------------Product : Fedora Core 4 Name : apr Version : 0.9.6 Release : 3.1 Summary : Apache Portable Runtime library Description : The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines, forming a system portability layer to as many operating systems as possible, including Unices, MS Win32, BeOS and OS/2. ---------------------------------------------------------------------Update Information: This update includes an updated libtool script to synchronize with the gcc 4.0.1 update. ---------------------------------------------------------------------* Tue Jul 26 2005 Joe Orton 0.9.6-3.1 - rebuild for new gcc ---------------------------------------------------------------------This update can be downloaded from: dd7c3dd24a5104bfaf0306704c328184 SRPMS/apr-0.9.6-3.1.src.rpm d2c78fee6749e882443e99982c376715 ppc/apr-0.9.6-3.1.ppc.rpm ff9a57982d8a2c88950e66e40d2aa14c ppc/apr-devel-0.9.6-3.1.ppc.rpm 13601fe4ecaf3f26c24d6ab8c96829ae ppc/debug/apr-debuginfo-0.9.6-3.1.ppc.rpm 379908eb9a22194cae703d3f6dc446c3 ppc/apr-0.9.6-3.1.ppc64.rpm 7ce0fa537f658bb9ac43b5dbc1d0f38c x86_64/apr-0.9.6-3.1.x86_64.rpm 0a5f2f241746b1c764117861527ccfaa x86_64/apr-devel-0.9.6-3.1.x86_64.rpm 95ac9d204d8a3fe15d3483a69c201155 x86_64/debug/apr-debuginfo-0.9.6-3.1.x86_64.rpm 29a5e1475389f0a61a02b0a548fddc5e x86_64/apr-0.9.6-3.1.i386.rpm 29a5e1475389f0a61a02b0a548fddc5e i386/apr-0.9.6-3.1.i386.rpm 9483fab79afbdee821d23db6cb28c53a i386/apr-devel-0.9.6-3.1.i386.rpm 5a67cf90a64e6c77b4fab9d118c2d762 i386/debug/apr-debuginfo-0.9.6-3.1.i386.rpm This update can also be installed with the Update Agent; youcan launch the Update Agent with the 'up2date' command. -----------------------------------------------------------------------fedora-announce-list mailing list
Get the latest Linux and open source security news straight to your inbox.