deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-7047
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "libxpc" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99883; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207922
CVE: CVE-2017-7048
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99885; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7049
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99885; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7050
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99882; http://www.securitytracker.com/id/1038951; https://support.apple.com/HT207922
CVE: CVE-2017-7051
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99882; http://www.securitytracker.com/id/1038951; https://support.apple.com/HT207922
CVE: CVE-2017-7052
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99885; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7053
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iTunes before 12.6.2 on Windows is affected. The issue involves the "iTunes" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/99884; https://support.apple.com/HT207928; http://www.securityfocus.com/bid/99884
CVE: CVE-2017-7054
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99882; http://www.securitytracker.com/id/1038951; https://support.apple.com/HT207922
CVE: CVE-2017-7055
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99885; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7056
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99885; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7058
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "Notifications" component. It allows physically proximate attackers to read unintended notifications on the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99891; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207923
CVE: CVE-2017-7059
Published: 2017-07-20
Description: A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99886; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7060
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. The issue involves the "Safari Printing" component. It allows remote attackers to cause a denial of service (excessive print dialogs) via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99887; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7061
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99885; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7062
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "Contacts" component. A buffer overflow allows remote attackers to execute arbitrary code or cause a denial of service (application crash).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99883; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207922
CVE: CVE-2017-7063
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. watchOS before 3.2.3 is affected. The issue involves the "Messages" component. It allows remote attackers to cause a denial of service (memory consumption and application crash).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.securityfocus.com/bid/99881; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207923
CVE: CVE-2017-7064
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. The issue involves the "WebKit" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/99890; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207921
CVE: CVE-2017-7067
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/99882; http://www.securitytracker.com/id/1038951; https://support.apple.com/HT207922
CVE: CVE-2017-7068
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "libarchive" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99883; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207922
CVE: CVE-2017-7069
Published: 2017-07-20
Description: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/99883; http://www.securitytracker.com/id/1038950; https://support.apple.com/HT207922
CVE: CVE-2017-0378
Published: 2017-07-20
Description: XSS exists in the login_form function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATH_INFO to main.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2017/07/20/3; http://www.phamm.org/docs/CHANGELOG; http://www.securityfocus.com/bid/99927
CVE: CVE-2017-11495
Published: 2017-07-20
Description: PHICOMM K2(PSG1218) devices V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script; alternatively, the attacker can leverage unauthenticated access to this script to trigger a reboot via an ifType=reboot action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/ZIllR0/Routers/blob/master/PHICOMM; https://github.com/ZIllR0/Routers/blob/master/PHICOMM
CVE: CVE-2017-11500
Published: 2017-07-20
Description: A directory traversal vulnerability exists in MetInfo 5.3.17. A remote attacker can use ..\ to delete any .zip file via the filenames parameter to /admin/system/database/filedown.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://blackwolfsec.cc/2017/07/20/Metinfo-directory-traversal-bypass/; http://blackwolfsec.cc/2017/07/20/Metinfo-directory-traversal-bypass/
CVE: CVE-2017-11468
Published: 2017-07-20
Description: Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00047.html; https://access.redhat.com/errata/RHSA-2017:2603; https://github.com/docker/distribution/pull/2340
CVE: CVE-2017-11501
Published: 2017-07-20
Description: NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://openwall.com/lists/oss-security/2017/07/20/1; https://github.com/NixOS/nixpkgs/issues/27506; https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk
CVE: CVE-2017-11502
Published: 2017-07-20
Description: Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with "GET /../" on TCP port 4321.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://blogs.securiteam.com/index.php/archives/2911#more-2911; https://blogs.securiteam.com/index.php/archives/2911#more-2911
CVE: CVE-2017-11503
Published: 2017-07-20
Description: PHPMailer 5.2.23 has XSS in the "From Email Address" and "To Email Address" fields of code_generator.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/99293/; http://www.securitytracker.com/id/1039026; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2017-10993
Published: 2017-07-21
Description: Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://contao.org/en/news/contao-3_5_28.html; https://contao.org/en/news/contao-3_5_28.html
CVE: CVE-2017-9930
Published: 2017-07-21
Description: Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by a request to ajax.cgi that enables UPnP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://iscouncil.blogspot.com/2017/07/green-packet-dx-350-vulnerable-to-csrf.html; https://iscouncil.blogspot.com/2017/07/green-packet-dx-350-vulnerable-to-csrf.html
CVE: CVE-2017-9931
Published: 2017-07-21
Description: Cross-Site Scripting (XSS) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to ajax.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://iscouncil.blogspot.com/2017/07/green-packet-dx-350-vulnerable-to-cross.html; https://iscouncil.blogspot.com/2017/07/green-packet-dx-350-vulnerable-to-cross.html
CVE: CVE-2017-9932
Published: 2017-07-21
Description: Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://iscouncil.blogspot.com/2017/07/authentication-bypass-in-green-packet.html; https://iscouncil.blogspot.com/2017/07/authentication-bypass-in-green-packet.html
CVE: CVE-2017-9980
Published: 2017-07-21
Description: In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" (aka tag_ipPing) feature within the web interface allows performing command injection, via the "pip" parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://iscouncil.blogspot.com/2017/07/command-injection-in-green-packet-dx.html; https://iscouncil.blogspot.com/2017/07/command-injection-in-green-packet-dx.html
CVE: CVE-2015-1323
Published: 2017-07-21
Description: The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/75221; http://www.ubuntu.com/usn/USN-2648-1; http://www.securityfocus.com/bid/75221
CVE: CVE-2015-3170
Published: 2017-07-21
Description: selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-254
References: https://bugzilla.redhat.com/show_bug.cgi?id=1218672; https://bugzilla.redhat.com/show_bug.cgi?id=1218672
CVE: CVE-2015-3198
Published: 2017-07-21
Description: The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1224787; https://developer.jboss.org/message/927301#927301; https://issues.jboss.org/browse/WFLY-4595
CVE: CVE-2015-3421
Published: 2017-07-21
Description: The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/74477; https://www.htbridge.com/advisory/HTB23255; http://www.securityfocus.com/bid/74477
CVE: CVE-2015-3638
Published: 2017-07-21
Description: phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configuration variable via a PHP variable variable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://openwall.com/lists/oss-security/2015/04/25/1; http://www.openwall.com/lists/oss-security/2015/05/04/4; http://www.securitytracker.com/id/1032250
CVE: CVE-2015-3639
Published: 2017-07-21
Description: phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2015/04/25/1; http://www.openwall.com/lists/oss-security/2015/05/04/4; http://www.securitytracker.com/id/1032250
CVE: CVE-2015-3640
Published: 2017-07-21
Description: phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2015/05/04/4; http://www.securitytracker.com/id/1032250; http://www.openwall.com/lists/oss-security/2015/05/04/4
CVE: CVE-2015-3886
Published: 2017-07-21
Description: libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: http://seclists.org/oss-sec/2015/q2/410; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783601; https://bugzilla.redhat.com/show_bug.cgi?id=1221266
CVE: CVE-2015-3931
Published: 2017-07-21
Description: Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
CVSS Score: 7.8 (HIGH)
CWE: CWE-91
References: http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html; http://www.neih.gov.hu/?q=node/66; http://www.securityfocus.com/bid/75487
CVE: CVE-2015-3932
Published: 2017-07-21
Description: Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
CVSS Score: 7.8 (HIGH)
CWE: CWE-91
References: http://packetstormsecurity.com/files/132473/Microsec-e-Szigno-Netlock-Mokka-XML-Signature-Wrapping.html; http://www.neih.gov.hu/?q=node/66; http://www.securityfocus.com/bid/75489
CVE: CVE-2015-4639
Published: 2017-07-21
Description: Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416#c4; https://koha-community.org/koha-3-14-16-released/; https://koha-community.org/security-release-koha-3-16-12/
CVE: CVE-2015-5194
Published: 2017-07-21
Description: The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrA; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html
CVE: CVE-2015-5195
Published: 2017-07-21
Description: ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.html
CVE: CVE-2015-5219
Published: 2017-07-21
Description: The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: http://aix.software.ibm.com/aix/efixes/security/ntp_advisory4.asc; http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=51786731Gr4-NOrTBC_a_uXO4wuGhg; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html
CVE: CVE-2015-5300
Published: 2017-07-21
Description: The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
CVSS Score: 7.5 (HIGH)
CWE: CWE-361
References: http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html