File _patchinfo of Package patchinfo.9120

<patchinfo incident="9120">
  <issue tracker="bnc" id="1083424">VUL-1: CVE-2018-7170: ntp: Ephemeral association time spoofing additional protection</issue>
  <issue tracker="bnc" id="1098531">VUL-1: CVE-2018-12327: ntp: Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows anattacker to achieve code execution or escalate to higher privileges via a longstring as the argument for an IPv4 or IPv6 command-li</issue>
  <issue tracker="bnc" id="1111853">VUL-1: ntp: ntp-4.2.8p12 bugfix and security release</issue>
  <issue tracker="cve" id="2018-12327"/>
  <issue tracker="cve" id="2018-7170"/>
  <category>security</category>
  <rating>moderate</rating>
  <packager>rmax</packager>
  <description>
NTP was updated to 4.2.8p12 (bsc#1111853):

- CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
- CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

</description>
  <summary>Security update for ntp</summary>
</patchinfo>