164 matches found
CVE-2026-121505
An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...
CVE-2026-121506 Out-of-bounds Write in NTPsec
An out-of-bounds read and write in NTS client extension field parsing extensclientrecv in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2....
CVE-2026-121506
The NTPsec software (versions before 1.2.5 ) is vulnerable to an out-of-bounds read and write during NTS client extension field parsing within the extens_client_recv function. A remote attacker capable of sending NTP server-mode replies to an NTS client can exploit this to corrupt heap memory and...
EUVD-2026-115826
An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...
CVE-2026-121505 Out-of-bounds Read in NTPsec
An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...
CVE-2026-121505
NTPsec versions before 1.2.4 are vulnerable to an out-of-bounds read in the nts_client_process_response_core function of the NTS-KE client response parser. A malicious NTS-KE server can trigger this by sending a record where the declared length exceeds the actual data received. This allows the se...
CVE-2026-121505: NTPsec: An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4…
An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...
[SECURITY] Fedora 43 Update: ntpd-rs-1.7.2-3.fc43
Full-featured implementation of NTP with NTS support...
[SECURITY] Fedora 44 Update: ntpd-rs-1.7.2-3.fc44
Full-featured implementation of NTP with NTS support...
[SECURITY] Fedora 45 Update: ntpd-rs-1.7.2-3.fc45
Full-featured implementation of NTP with NTS support...
CLEANSTART-2024-CO07022 ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3)
Security vulnerability affects the ntpsec package. ntpd will crash if the server is not NTS-enabled no certificate and it receives an NTS-enabled client request mode 3...
CVE-2026-102486
A flaw was found in NTPsec. This flaw allows a remote attacker to cause a Denial of Service DoS by crashing the NTP daemon. The issue is caused by an out-of-bounds read vulnerability when parsing Network Time Security NTS extension fields that contain an Authenticator and Encrypted Extension Fiel...
SUSE CVE-2026-102483
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields...
SUSE CVE-2026-102486
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields AEEF field with an oversized nonce length...
Linux Distros Unpatched Vulnerability : CVE-2026-102486
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and...
Linux Distros Unpatched Vulnerability : CVE-2026-102483
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extensi...
DEBIAN-CVE-2026-102486
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields AEEF field with an oversized nonce length...
CVE-2026-102486
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields AEEF field with an oversized nonce length...