4.2.8p5 Release Announcement

Last update: June 28, 2022 21:06 UTC (1f97faf40)

NTF’s NTP Project has been notified of the following 1 medium-severity vulnerability that is fixed in ntp-4.2.8p5, released on Thursday, 7 January 2016:

• 2956: Small-step/Big-step / CVE-2015-5300

ntp-4.2.8p5 also fixes:

• A number of Coverity nits were fixed in the new Unity tests.
• 2829: Clean up pipe_fds in ntpd.c
• 2887: stratum -1 config results as showing value 99
• 2932: Update leapsecond file info in miscopt.html
• 2934: tests/ntpd/t-ntp_scanner.c has a magic constant wired in
• 2944: errno is not preserved properly in ntpdate after sendto call
• 2952: peer associations were broken by the fix for 2901 / CVE-2015-7704
• 2954: Version 4.2.8p4 crashes on startup on some OSes
• 2957: ‘unsigned int’ vs ‘size_t’ format clash
• 2958: ntpq: fatal error messages need a final newline
• 2962: truncation of size_t/ptrdiff_t on 64bit targets
• 2965: Local clock didn’t work since 4.2.8p4
• 2967: ntpdate command suffers an assertion failure
• 2969: Seg fault from ntpq/mrulist when looking at server with lots of clients
• 2971: ntpq bails on ^C: select fails: Interrupted system call

---

Timeline:

• 2016 Jan 7: Public release
• 2016 Jan 4: CERT notified and pre-release patch availability announced to CERT
• 2016 Jan 4: Early Access Program Release: Premier and Partner Institutional Members
• 2015 Oct 16: Notification to Institutional Members
• 2016 Oct 8: Initial notification; analysis begins