Synopsis:          Important: ntp security update
Advisory ID:       SLSA-2016:0063-1
Issue Date:        2016-01-25
CVE Numbers:       CVE-2015-8138
--

It was discovered that ntpd as a client did not correctly check the
originate timestamp in received packets. A remote attacker could use this
flaw to send a crafted packet to an ntpd client that would effectively
disable synchronization with the server, or push arbitrary offset/delay
measurements to modify the time on the client. (CVE-2015-8138)

After installing the update, the ntpd daemon will restart automatically.
--

SL6
  x86_64
    ntp-4.2.6p5-5.el6_7.4.x86_64.rpm
    ntp-debuginfo-4.2.6p5-5.el6_7.4.x86_64.rpm
    ntpdate-4.2.6p5-5.el6_7.4.x86_64.rpm
    ntp-perl-4.2.6p5-5.el6_7.4.x86_64.rpm
  i386
    ntp-4.2.6p5-5.el6_7.4.i686.rpm
    ntp-debuginfo-4.2.6p5-5.el6_7.4.i686.rpm
    ntpdate-4.2.6p5-5.el6_7.4.i686.rpm
    ntp-perl-4.2.6p5-5.el6_7.4.i686.rpm
  noarch
    ntp-doc-4.2.6p5-5.el6_7.4.noarch.rpm
SL7
  x86_64
    ntp-4.2.6p5-22.el7_2.1.x86_64.rpm
    ntp-debuginfo-4.2.6p5-22.el7_2.1.x86_64.rpm
    ntpdate-4.2.6p5-22.el7_2.1.x86_64.rpm
    sntp-4.2.6p5-22.el7_2.1.x86_64.rpm
  noarch
    ntp-doc-4.2.6p5-22.el7_2.1.noarch.rpm
    ntp-perl-4.2.6p5-22.el7_2.1.noarch.rpm

- Scientific Linux Development Team