4.2.8p8 Release Announcement

Last update: September 3, 2026 14:42 UTC (1eec487e7)

NTF’s NTP Project has been notified of the following 1 high- and 4 low-severity vulnerabilities, which are fixed in ntp-4.2.8p8.

ntp-4.2.8p8 is scheduled to be released on 2 June 2016.

• 3046: Crypto-NAK crash / CVE-2016-4957
  • Reported by Nicolas Edet of Cisco.
• 3045: Bad authentication demobilizes ephemeral associations / CVE-2016-4953
  • Reported by Miroslav Lichvar of Red Hat.
• 3044: Processing spoofed server packets / CVE-2016-4954
  • Reported by Jakub Prokes of Red Hat.
• 3043: Autokey association reset / CVE-2016-4955
  • Reported by Miroslav Lichvar of Red Hat.
• 3042: Broadcast interleave / CVE-2016-4956
  • Reported by Miroslav Lichvar of Red Hat.

---

Timeline:

• 2016 Jun 02: Public release
• 2016 May 26: CERT notification, including availability of pre-release patches
• 2016 May 24: Early Access Program Release: Premier and Partner Institutional Members
• : Notification to Institutional Members
• : Report received