File _patchinfo of Package patchinfo.4454

<patchinfo incident="4454">
  <issue id="1014172" tracker="bnc">L3-Question: New ntpd Kiss-of-Death messages in peer configurations raise false alarms</issue>
  <issue id="1030050" tracker="bnc">VUL-0: ntpd:  NTP.org ntpd security updates notification</issue>
  <issue id="2016-9042" tracker="cve" />
  <issue id="2017-6451" tracker="cve" />
  <issue id="2017-6458" tracker="cve" />
  <issue id="2017-6460" tracker="cve" />
  <issue id="2017-6462" tracker="cve" />
  <issue id="2017-6463" tracker="cve" />
  <issue id="2017-6464" tracker="cve" />
  <issue id="321003" tracker="fate" />
  <category>security</category>
  <rating>moderate</rating>
  <packager>rmax</packager>
  <description>
This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See
/usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050):

- CVE-2017-6464: Denial of Service via Malformed Config
- CVE-2017-6462: Buffer Overflow in DPTS Clock
- CVE-2017-6463: Authenticated DoS via Malicious Config Option
- CVE-2017-6458: Potential Overflows in ctl_put() functions
- CVE-2017-6451: Improper use of snprintf() in mx4200_send()
- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
- CVE-2016-9042: 0rigin (zero origin) DoS.
- ntpq_stripquotes() returns incorrect Value
- ereallocarray()/eallocarray() underused
- Copious amounts of Unused Code
- Off-by-one in Oncore GPS Receiver
- Makefile does not enforce Security Flags

Bugfixes:

- Remove spurious log messages (bsc#1014172).
- clang scan-build findings
- Support for openssl-1.1.0 without compatibility modes
- Bugfix 3072 breaks multicastclient
- forking async worker: interrupted pipe I/O
- (...) time_pps_create: Exec format error
- Incorrect Logic for Peer Event Limiting
- Change the process name of forked DNS worker
- Trap Configuration Fail
- Nothing happens if minsane &lt; maxclock &lt; minclock
- allow -4/-6 on restrict line with mask
- out-of-bound pointers in ctl_putsys and decode_bitflags
- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for
  transactional updates.
</description>
  <summary>Security update for ntp</summary>
</patchinfo>