CVE-2016-9311: Null Pointer Dereference
Published Jan 13, 2017
·Updated
Last updated 25 August 2025
Other sources
ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.
— Launchpad
Affected Software
2 affected componentsFixes available
debian/ntp
1:4.2.8p15+dfsg-1
NTP ntp<=4.2.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ntpto a version that resolves this vulnerability.Fixed in 1:4.2.8p15+dfsg-1 - Upgrade
Upgrade
ntpdto a version that resolves this vulnerability.Fixed in 4.2.8p9
Event History
Jan 13, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:59 PM
DescriptionSeverityWeaknessAffected Software
Feb 19, 2026
Data Sourced
via Ubuntu·06:26 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·06:26 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2016-9311.
2
What is the severity of CVE-2016-9311?
The severity of CVE-2016-9311 is high.
3
Which software versions are affected by CVE-2016-9311?
NTP versions before 4.2.8p9 are affected by CVE-2016-9311.
4
How can a remote attacker exploit CVE-2016-9311?
A remote attacker can exploit CVE-2016-9311 by sending a crafted packet to the trap service of the vulnerable NTP server.
5
Is there a fix available for CVE-2016-9311?
Yes, the fix for CVE-2016-9311 is included in NTP version 4.2.8p9 and later.