SUSE-SU-2017:1047-1

Описание

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050):

• CVE-2017-6464: Denial of Service via Malformed Config
• CVE-2017-6462: Buffer Overflow in DPTS Clock
• CVE-2017-6463: Authenticated DoS via Malicious Config Option
• CVE-2017-6458: Potential Overflows in ctl_put() functions
• CVE-2017-6451: Improper use of snprintf() in mx4200_send()
• CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
• CVE-2016-9042: 0rigin (zero origin) DoS.
• ntpq_stripquotes() returns incorrect Value
• ereallocarray()/eallocarray() underused
• Copious amounts of Unused Code
• Off-by-one in Oncore GPS Receiver
• Makefile does not enforce Security Flags

Bugfixes:

• Remove spurious log messages (bsc#1014172).
• clang scan-build findings
• Support for openssl-1.1.0 without compatibility modes
• Bugfix 3072 breaks multicastclient
• forking async worker: interrupted pipe I/O
• (...) time_pps_create: Exec format error
• Incorrect Logic for Peer Event Limiting
• Change the process name of forked DNS worker
• Trap Configuration Fail
• Nothing happens if minsane < maxclock < minclock
• allow -4/-6 on restrict line with mask
• out-of-bound pointers in ctl_putsys and decode_bitflags
• Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.