Tuxfamily
Tuxfamily Chrony: vulnerabilidades y CVE
Tuxfamily Chrony tiene 10 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE10
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2020-14367 | Media (6) | 0.48% | — | 24 ago 2020 | A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for… |
| CVE-2015-1853 | Media (6.5) | 1.7% | — | 9 dic 2019 | chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to… |
| CVE-2016-1567 | Alta (8.1) | 3.0% | — | 26 ene 2016 | chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key,… |
| CVE-2015-1822 | Media (6.5) | 2.9% | — | 16 abr 2015 | chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer… |
| CVE-2015-1821 | Media (6.5) | 3.4% | — | 16 abr 2015 | Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a… |
| CVE-2012-4503 | Media (5) | 3.1% | — | 5 nov 2013 | cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the… |
| CVE-2012-4502 | Media (5) | 3.2% | — | 5 nov 2013 | Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the… |
| CVE-2010-0294 | Media (5) | 2.7% | — | 8 feb 2010 | chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large number… |
| CVE-2010-0293 | Media (5) | 2.7% | — | 8 feb 2010 | The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory… |
| CVE-2010-0292 | Media (5) | 1.7% | — | 8 feb 2010 | The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon packet… |