4.2.8p3 Release Announcement

Last update: September 3, 2026 14:42 UTC (1eec487e7)

NTF’s NTP Project has been notified of a minor vulnerability in the processing of a crafted remote-configuration packet. Remote configuration is disabled by default. This issue was discovered and reported byAleksis Kauppinen of Codenomicon.

• 2853: ntpd control message crash: Crafted NUL-byte in configuration directive / CVE-2015-5146

---

Timeline:

• 2015 Jun 29: Public release
• 2015 Jun 24: Early Access Program Release: Premier and Partner Institutional Members
• 2015 Jun 22: Notification to Institutional Members
• 2015 Jun 16: Notification received from FICORA; analysis begins
• 2015 May 12: 4.2.8p3-RC1 released