Package "chrony"
Name: |
chrony
|
Description: |
Set the computer clock from time servers on the Net
|
Latest version: |
1.29-1ubuntu0.1 |
Release: |
trusty (14.04) |
Level: |
security |
Repository: |
universe |
Homepage: |
http://chrony.tuxfamily.org |
Links
Download "chrony"
Other versions of "chrony" in Trusty
Changelog
chrony (1.29-1ubuntu0.1) trusty-security; urgency=medium
* SECURITY UPDATE: Heap-based buffer overflow
- debian/patches/CVE-2015-1821.patch: Fix access configuration with
subnet size indivisible by 4.
- CVE-2015-1821
* SECURITY UPDATE: DoS (uninitialized pointer dereference and daemon
crash) or possibly execute arbitrary code via a large number of
command requests.
- debian/patches/CVE-2015-1822.patch: Fix initialization of allocated
reply slots.
- CVE-2015-1822
* SECURITY UPDATE: Authentication doesn't protect symmetric associations
against DoS attacks
- debian/patches/CVE-2015-1853.patch: Protect authenticated symmetric
associations against DoS attacks.
- CVE-2015-1853
* SECURITY UPDATE: Remote attackers to conduct impersonation attacks via
an arbitrary trusted key, aka a "skeleton key".
- debian/patches/CVE-2016-1567.patch: restrict authentication of
server/peer to specified key.
- CVE-2016-1567
-- Eduardo Barretto <email address hidden> Wed, 05 Dec 2018 17:57:24 -0200
|
CVE-2015-1821 |
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute |
CVE-2015-1822 |
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenti |
CVE-2015-1853 |
authentication doesn't protect symmetric associations against DoS attacks |
CVE-2016-1567 |
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote att |
|
About
-
Send Feedback to @ubuntu_updates