CVE-2015-7977

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-30 · updated 2026-06-17
Weakness: CWE-476

Description

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04
Debian Linux: 8.0, 9.0
Fedoraproject Fedora: 22, 23
FreeBSD: 9.3, 9.3-p1, 9.3-p10, 9.3-p12, 9.3-p13, 9.3-p16 (+50)
Clustered Data ONTAP: all versions
NetApp Oncommand Balance: all versions
NTP: through 4.2.8; from 4.3.0 before 4.3.90; 4.2.8, 4.2.8-p1, 4.2.8-p1-beta1, 4.2.8-p1-beta2, 4.2.8-p1-beta3, 4.2.8-p1-beta4 (+13) — fixed in 4.3.90
Oracle Corporation Oracle Linux: 6
Siemens Tim 4R-Ie Dnp3 Firmware: all versions
Siemens Tim 4R-Ie Firmware: all versions

How to fix

Upgrade to a fixed version: NTP 4.3.90. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2015-7977 or the next vulnerability affects your stack