Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Chrony before 1.29 may leak memory data to attackers

CVE-2012-4503 · published 13 years ago
Summary

Older versions of the Chrony time‑synchronization service can accidentally include leftover data from its memory when responding to certain network requests. This could let a remote user see information that should be private. Upgrade Chrony to version 1.29 or later to stop the leak.

What to do
  • Update debian chrony to version 1.29-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian chrony < 1.29-1
Fix: upgrade to 1.29-1
Debian:13 debian chrony < 1.29-1
Fix: upgrade to 1.29-1
Debian:14 debian chrony < 1.29-1
Fix: upgrade to 1.29-1
– tuxfamily chrony <= 1.28
1.0
1.1
1.18
1.19
1.19.99.1
1.19.99.2
1.19.99.3
1.20
1.21
1.23
1.23.1
5 more version ranges
cpe:2.3:a:tuxfamily:chrony:*:*:*:*:*:*:*:*
Original advisory text
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command t...
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.
References
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published5 Nov 2013
Updated31 Oct 2026
First seen3 Sep 2026
Sources
DEBIAN-CVE-2012-4503 · OSV
CVE-2012-4503 · NVD
Track software like this
Free during beta