8.8
CVE-2015-7849
- EPSS 16.85%
- Veröffentlicht 07.08.2017 20:29:00
- Zuletzt bearbeitet 13.05.2026 00:24:29
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginUse-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netapp ≫ Oncommand Balance Version-
Netapp ≫ Oncommand Performance Manager Version-
Netapp ≫ Oncommand Unified Manager Version- SwPlatformclustered_data_ontap
Netapp ≫ Clustered Data Ontap Version-
Netapp ≫ Data Ontap Version- SwPlatform7-mode
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 16.85% | 0.967 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
CWE-416 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
https://security.gentoo.org/glsa/201607-15
http://www.securitytracker.com/id/1033951
https://security.netapp.com/advisory/ntap-20171004-0001/
http://support.ntp.org/bin/view/Main/NtpBug2916
http://www.securityfocus.com/bid/77276
https://bugzilla.redhat.com/show_bug.cgi?id=1274257