Merge ~kick-d/ubuntu/+source/ntp:logical/4.2.6.p5+dfsg-3ubuntu9 into ~ubuntu-server-dev/ubuntu/+source/ntp:logical

[Kick In]

Logical changes from ubuntu

[Robie Basak (racb)]

Hi Pierre,

Good job on this one. The only diff between this and 1:4.2.6.p5+dfsg-3ubuntu9 are debian/changelog and update-maintainer as I expect.

Good job also squashing down all the different Apparmor-related changes into one commit.

My only complaint is on commits 93ec5cb and 8c7e386. These both touch the same lines in debian/ntpdate.if-up. In 8c7e386 the "LOCKFILE" line is changed and "invoke-rc.d" lines added, and in 93ec5cb the "LOCKFILE" line is changed back again and one of the previously added "invoke-rc.d" lines is moved. This is churn that we want to squash out at this logical stage.

For example:

@@ -30,7 +30,7 @@ if [ -r /lib/udev/hotplug.functions ]; then
        wait_for_file /usr/sbin/ntpdate-debian
 fi

-LOCKFILE=/var/lock/ntpdate
+LOCKFILE=/var/lock/ntpdate-ifup

 # Avoid running more than one at a time
 if [ -x /usr/bin/lockfile-create ]; then

and then later:

@@ -30,7 +30,7 @@ if [ -r /lib/udev/hotplug.functions ]; then
        wait_for_file /usr/sbin/ntpdate-debian
 fi

-LOCKFILE=/var/lock/ntpdate-ifup
+LOCKFILE=/var/lock/ntpdate

 # Avoid running more than one at a time
 if [ -x /usr/bin/lockfile-create ]; then

Indicate churn to me. When figuring out the logical set of changes made, these hunks cancel out and so should not appear at all. The same applies to one of the two invoke-rc.d lines.

I would split "debian/ntpdate.if-up: Fix interaction with openntpd", which I take to be the "if [ -e /usr/sbin/openntpd ]; then" stanza into its own commit. Then there would be a separate commit that doesn't need to touch LOCKFILE and just adds the two invoke-rc.d lines directly into their final places. Since this distils the previous uploads, the commit messages will probably need tweaking a little so that they make sense.

Apart from this, everything else is byte-perfect. I'm not sure it's necessary to redo this. It's minor enough that I can probably just keep it in mind while reviewing your merge. So I'll do that next. No action needed here for now. Thanks!

[Kick In (kick-d)]

Thanks, and sorry for this one. I kept this in my head, and forgot to
squash.

2016-01-28 14:31 GMT+01:00 Robie Basak <email address hidden>:

> Hi Pierre,
>
> Good job on this one. The only diff between this and
> 1:4.2.6.p5+dfsg-3ubuntu9 are debian/changelog and update-maintainer as I
> expect.
>
> Good job also squashing down all the different Apparmor-related changes
> into one commit.
>
> My only complaint is on commits 93ec5cb and 8c7e386. These both touch the
> same lines in debian/ntpdate.if-up. In 8c7e386 the "LOCKFILE" line is
> changed and "invoke-rc.d" lines added, and in 93ec5cb the "LOCKFILE" line
> is changed back again and one of the previously added "invoke-rc.d" lines
> is moved. This is churn that we want to squash out at this logical stage.
>
> For example:
>
> @@ -30,7 +30,7 @@ if [ -r /lib/udev/hotplug.functions ]; then
> wait_for_file /usr/sbin/ntpdate-debian
> fi
>
> -LOCKFILE=/var/lock/ntpdate
> +LOCKFILE=/var/lock/ntpdate-ifup
>
> # Avoid running more than one at a time
> if [ -x /usr/bin/lockfile-create ]; then
>
>
> and then later:
>
> @@ -30,7 +30,7 @@ if [ -r /lib/udev/hotplug.functions ]; then
> wait_for_file /usr/sbin/ntpdate-debian
> fi
>
> -LOCKFILE=/var/lock/ntpdate-ifup
> +LOCKFILE=/var/lock/ntpdate
>
> # Avoid running more than one at a time
> if [ -x /usr/bin/lockfile-create ]; then
>
> Indicate churn to me. When figuring out the logical set of changes made,
> these hunks cancel out and so should not appear at all. The same applies to
> one of the two invoke-rc.d lines.
>
> I would split "debian/ntpdate.if-up: Fix interaction with openntpd", which
> I take to be the "if [ -e /usr/sbin/openntpd ]; then" stanza into its own
> commit. Then there would be a separate commit that doesn't need to touch
> LOCKFILE and just adds the two invoke-rc.d lines directly into their final
> places. Since this distils the previous uploads, the commit messages will
> probably need tweaking a little so that they make sense.
>
> Apart from this, everything else is byte-perfect. I'm not sure it's
> necessary to redo this. It's minor enough that I can probably just keep it
> in mind while reviewing your merge. So I'll do that next. No action needed
> here for now. Thanks!
> --
>
> https://code.launchpad.net/~kick-d/ubuntu/+source/ntp/+git/ntp/+merge/284274
> You are the owner of
> ~kick-d/ubuntu/+source/ntp:logical/4.2.6.p5+dfsg-3ubuntu9.
>

[Kick In (kick-d)]

OK I'll split this out in my merge proposal.

2016-01-28 15:27 GMT+01:00 Pierre-Andre Morey <
<email address hidden>>:

> Thanks, and sorry for this one. I kept this in my head, and forgot to
> squash.
>
> 2016-01-28 14:31 GMT+01:00 Robie Basak <email address hidden>:
>
>> Hi Pierre,
>>
>> Good job on this one. The only diff between this and
>> 1:4.2.6.p5+dfsg-3ubuntu9 are debian/changelog and update-maintainer as I
>> expect.
>>
>> Good job also squashing down all the different Apparmor-related changes
>> into one commit.
>>
>> My only complaint is on commits 93ec5cb and 8c7e386. These both touch the
>> same lines in debian/ntpdate.if-up. In 8c7e386 the "LOCKFILE" line is
>> changed and "invoke-rc.d" lines added, and in 93ec5cb the "LOCKFILE" line
>> is changed back again and one of the previously added "invoke-rc.d" lines
>> is moved. This is churn that we want to squash out at this logical stage.
>>
>> For example:
>>
>> @@ -30,7 +30,7 @@ if [ -r /lib/udev/hotplug.functions ]; then
>> wait_for_file /usr/sbin/ntpdate-debian
>> fi
>>
>> -LOCKFILE=/var/lock/ntpdate
>> +LOCKFILE=/var/lock/ntpdate-ifup
>>
>> # Avoid running more than one at a time
>> if [ -x /usr/bin/lockfile-create ]; then
>>
>>
>> and then later:
>>
>> @@ -30,7 +30,7 @@ if [ -r /lib/udev/hotplug.functions ]; then
>> wait_for_file /usr/sbin/ntpdate-debian
>> fi
>>
>> -LOCKFILE=/var/lock/ntpdate-ifup
>> +LOCKFILE=/var/lock/ntpdate
>>
>> # Avoid running more than one at a time
>> if [ -x /usr/bin/lockfile-create ]; then
>>
>> Indicate churn to me. When figuring out the logical set of changes made,
>> these hunks cancel out and so should not appear at all. The same applies to
>> one of the two invoke-rc.d lines.
>>
>> I would split "debian/ntpdate.if-up: Fix interaction with openntpd",
>> which I take to be the "if [ -e /usr/sbin/openntpd ]; then" stanza into its
>> own commit. Then there would be a separate commit that doesn't need to
>> touch LOCKFILE and just adds the two invoke-rc.d lines directly into their
>> final places. Since this distils the previous uploads, the commit messages
>> will probably need tweaking a little so that they make sense.
>>
>> Apart from this, everything else is byte-perfect. I'm not sure it's
>> necessary to redo this. It's minor enough that I can probably just keep it
>> in mind while reviewing your merge. So I'll do that next. No action needed
>> here for now. Thanks!
>> --
>>
>> https://code.launchpad.net/~kick-d/ubuntu/+source/ntp/+git/ntp/+merge/284274
>> You are the owner of
>> ~kick-d/ubuntu/+source/ntp:logical/4.2.6.p5+dfsg-3ubuntu9.
>>
>
>

[Robie Basak (racb)]

This was resolved. Not merged, but superseded by the real merge.

review: Needs Resubmitting

[Robie Basak (racb)]

(not sure how to set the merge status to "Superseded")

review: Disapprove

Unmerged commits

c8a02ba... by Kick In on 2016-01-14

  * SECURITY UPDATE: symmetric association authentication bypass via
    crypto-NAK
    - debian/patches/CVE-2015-7871.patch: drop unhandled packet in
      ntpd/ntp_proto.c.
    - CVE-2015-7871

da8c14c... by Kick In on 2016-01-14

  * SECURITY UPDATE: denial of service via ASSERT in decodenetnum
    - debian/patches/CVE-2015-7855.patch: simply return fail in
      libntp/decodenetnum.c.
    - CVE-2015-7855

f0f93bb... by Kick In on 2016-01-14

  * SECURITY UPDATE: buffer overflow via custom refclock driver
    - debian/patches/CVE-2015-7853.patch: properly calculate length in
      ntpd/ntp_io.c.
    - CVE-2015-7853

bca2843... by Kick In on 2016-01-14

  * SECURITY UPDATE: ntpq atoascii memory corruption
    - debian/patches/CVE-2015-7852.patch: avoid buffer overrun in
      ntpq/ntpq.c.
    - CVE-2015-7852

9af4d3a... by Kick In on 2016-01-14

  * SECURITY UPDATE: denial of service via same logfile and keyfile
    - debian/patches/CVE-2015-7850.patch: rate limit errors in
      include/ntp_stdlib.h, include/ntp_syslog.h, libntp/authreadkeys.c,
      libntp/msyslog.c.
    - CVE-2015-7850

56e59ee... by Kick In on 2016-01-14

  * SECURITY UPDATE: denial of service by spoofed KoD
    - debian/patches/CVE-2015-7704.patch: add check to ntpd/ntp_proto.c.
    - CVE-2015-7704
    - CVE-2015-7705

a64bbbd... by Kick In on 2016-01-14

  * SECURITY UPDATE: file overwrite via remote pidfile and driftfile
    configuration directives
    - debian/patches/CVE-2015-5196.patch: disable remote configuration in
      ntpd/ntp_parser.y.
    - CVE-2015-5196
    - CVE-2015-7703

b574fc2... by Kick In on 2016-01-14

  * SECURITY UPDATE: memory leak in CRYPTO_ASSOC
    - debian/patches/CVE-2015-7701.patch: add missing free in
      ntpd/ntp_crypto.c.
    - CVE-2015-7701

5afebc5... by Kick In on 2016-01-14

  * SECURITY UPDATE: incomplete autokey data packet length checks
    - debian/patches/CVE-2015-7691.patch: add length and size checks to
      ntpd/ntp_crypto.c.
    - CVE-2015-7691
    - CVE-2015-7692
    - CVE-2015-7702

d8365e5... by Kick In on 2016-01-14

  * SECURITY UPDATE: timeshifting by reboot issue
    - debian/patches/CVE-2015-5300.patch: disable panic in
      ntpd/ntp_loopfilter.c.
    - CVE-2015-5300

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
 new file mode 100644
index 0000000..48e8d7a
--- /dev/null
+++ b/debian/apparmor-profile
@@ -0,0 +1,81 @@
+# vim:syntax=apparmor
+# Updated for Ubuntu by: Jamie Strandboge <[e-mail]>
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2005 Novell/SUSE
+#    Copyright (C) 2009-2012 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#include <tunables/global>
+#include <tunables/ntpd>
+/usr/sbin/ntpd {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/user-tmp>
+
+  capability ipc_lock,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_resource,
+  capability sys_time,
+  capability sys_nice,
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+
+  @{PROC}/net/if_inet6 r,
+  @{PROC}/*/net/if_inet6 r,
+  @{NTPD_DEVICE} rw,
+
+  /{,s}bin/      r,
+  /usr/{,s}bin/  r,
+  /usr/sbin/ntpd rmix,
+
+  /etc/ntp.conf r,
+  /etc/ntp.conf.dhcp r,
+  /etc/ntpd.conf r,
+  /etc/ntpd.conf.tmp r,
+  /var/lib/ntp/ntp.conf.dhcp r,
+
+  /etc/ntp.keys r,
+  /etc/ntp/** r,
+
+  /etc/ntp.drift rwl,
+  /etc/ntp.drift.TEMP rwl,
+  /etc/ntp/drift* rwl,
+  /var/lib/ntp/*drift rw,
+  /var/lib/ntp/*drift.TEMP rw,
+
+  /var/log/ntp w,
+  /var/log/ntp.log w,
+  /var/log/ntpd w,
+  /var/log/ntpstats/clockstats* rwl,
+  /var/log/ntpstats/loopstats*  rwl,
+  /var/log/ntpstats/peerstats*  rwl,
+  /var/log/ntpstats/protostats* rwl,
+  /var/log/ntpstats/rawstats*   rwl,
+  /var/log/ntpstats/sysstats*   rwl,
+
+  /{,var/}run/ntpd.pid w,
+
+  # samba4 ntp signing socket
+  /{,var/}run/samba/ntp_signd/socket rw,
+
+  # For use with clocks that report via shared memory (e.g. gpsd),
+  # you may need to give ntpd access to all of shared memory, though
+  # this can be considered dangerous. See https://launchpad.net/bugs/722815
+  # for details. To enable, add this to local/usr.sbin.ntpd:
+  #     capability ipc_owner,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.ntpd>
+}
diff --git a/debian/apparmor-profile.tunable b/debian/apparmor-profile.tunable
 new file mode 100644
index 0000000..1fc2d8f
--- /dev/null
+++ b/debian/apparmor-profile.tunable
@@ -0,0 +1,15 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2002-2005 Novell/SUSE
+#    Copyright (C) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+#Add your ntpd devices here eg. if you have a DCF clock
+# @{NTPD_DEVICE}="/dev/ttyS1"
+@{NTPD_DEVICE}="/dev/null"
diff --git a/debian/control b/debian/control
index 5f175fd..f3624dd 100644
--- a/debian/control
+++ b/debian/control
@@ -3,7 +3,7 @@ Section: net
 Priority: optional
 Maintainer: Debian NTP Team <[e-mail]>
 Uploaders: Bdale Garbee <[e-mail]>, Peter Eisentraut <[e-mail]>, Kurt Roeckx <[e-mail]>
-Build-Depends: autotools-dev, debhelper (>= 6), libedit-dev, libcap2-dev [linux-any], libssl-dev (>= 1.0.0e-1), autogen (>= 1:5.11)
+Build-Depends: autotools-dev, debhelper (>= 6), libedit-dev, libcap2-dev [linux-any], libssl-dev (>= 1.0.0e-1), autogen (>= 1:5.11), hardening-wrapper, dh-apparmor, bison
 Build-Conflicts: libavahi-compat-libdnssd-dev, libwww-dev, libwww-ssl-dev
 Standards-Version: 3.9.3
 Homepage: http://support.ntp.org/
@@ -15,7 +15,9 @@ Architecture: any
 Depends: adduser, lsb-base (>= 3.2-13), netbase, ${misc:Depends}, ${shlibs:Depends}
 Pre-Depends: dpkg (>= 1.15.7.2)
 Recommends: ${perl:Depends}
-Suggests: ntp-doc
+Suggests: ntp-doc, apparmor (>= 2.1+1075-0ubuntu6)
+Conflicts: apparmor-profiles (<< 2.3.1+1403-0ubuntu10), apparmor (<< 2.3.1+1403-0ubuntu10)
+Replaces: apparmor-profiles (<< 2.3.1+1403-0ubuntu10), apparmor (<< 2.3.1+1403-0ubuntu10)
 Breaks: dhcp3-client (<< 4.1.0-1)
 Description: Network Time Protocol daemon and utility programs
  NTP, the Network Time Protocol, is used to keep computer clocks
diff --git a/debian/ntp.conf b/debian/ntp.conf
index cb7d021..4457652 100644
--- a/debian/ntp.conf
+++ b/debian/ntp.conf
@@ -11,18 +11,18 @@ filegen loopstats file loopstats type day enable
 filegen peerstats file peerstats type day enable
 filegen clockstats file clockstats type day enable
 
-
-# You do need to talk to an NTP server or two (or three).
-#server ntp.your-provider.example
-
-# pool.ntp.org maps to about 1000 low-stratum NTP servers.  Your server will
-# pick a different set every time it starts up.  Please consider joining the
-# pool: <http://www.pool.ntp.org/join.html>
-server 0.debian.pool.ntp.org iburst
-server 1.debian.pool.ntp.org iburst
-server 2.debian.pool.ntp.org iburst
-server 3.debian.pool.ntp.org iburst
-
+# Specify one or more NTP servers.
+
+# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board
+# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for
+# more information.
+server 0.ubuntu.pool.ntp.org
+server 1.ubuntu.pool.ntp.org
+server 2.ubuntu.pool.ntp.org
+server 3.ubuntu.pool.ntp.org
+
+# Use Ubuntu's ntp server as a fallback.
+server ntp.ubuntu.com
 
 # Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
 # details.  The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
diff --git a/debian/ntp.dhcp b/debian/ntp.dhcp
index a1acb21..a629d16 100644
--- a/debian/ntp.dhcp
+++ b/debian/ntp.dhcp
@@ -40,7 +40,7 @@ ntp_servers_setup_add() {
 		echo "server $server iburst"
 	  done
 	  echo
-	  sed -r -e '/^ *(server|peer).*$/d' $NTP_CONF
+	  sed -r -e '/^ *(server *[^1][^2][^7]\.|peer).*$/d' $NTP_CONF
 	) >>$tmp
 	
 	mv $tmp $NTP_DHCP_CONF
diff --git a/debian/ntp.dirs b/debian/ntp.dirs
index 49d3819..314ad95 100644
--- a/debian/ntp.dirs
+++ b/debian/ntp.dirs
@@ -1,3 +1,6 @@
 usr/sbin
 var/lib/ntp
 var/log/ntpstats
+etc/apparmor.d/force-complain
+etc/apparmor.d/tunables
+usr/share/apport/package-hooks
diff --git a/debian/ntp.init b/debian/ntp.init
index 3a5ccc5..9755091 100644
--- a/debian/ntp.init
+++ b/debian/ntp.init
@@ -5,7 +5,7 @@
 # Required-Start:  $network $remote_fs $syslog
 # Required-Stop:   $network $remote_fs $syslog
 # Default-Start:   2 3 4 5
-# Default-Stop: 
+# Default-Stop:    1
 # Short-Description: Start NTP daemon
 ### END INIT INFO
 
@@ -22,7 +22,7 @@ if [ -r /etc/default/ntp ]; then
 	. /etc/default/ntp
 fi
 
-if [ -e /var/lib/ntp/ntp.conf.dhcp ]; then
+if [ /var/lib/ntp/ntp.conf.dhcp -nt /etc/ntp.conf ]; then
 	NTPD_OPTS="$NTPD_OPTS -c /var/lib/ntp/ntp.conf.dhcp"
 fi
 
diff --git a/debian/ntp.preinst b/debian/ntp.preinst
index 3c9f0a0..25da0e3 100644
--- a/debian/ntp.preinst
+++ b/debian/ntp.preinst
@@ -18,5 +18,11 @@ if dpkg-maintscript-helper supports mv_conffile; then
 		1:4.2.6.p1+dfsg-1 -- "$@"
 fi
 
+if [ "$1" = install ] && [ -e /etc/ntp.conf ] && [ ! -s /etc/ntp.conf ]; then
+	# Work around system-tools-backends bug that left an empty file
+	# (https://bugs.launchpad.net/bugs/83604).
+	rm -f /etc/ntp.conf
+fi
+
 #DEBHELPER#
 
diff --git a/debian/ntpdate-debian b/debian/ntpdate-debian
index 4748b3a..c0f8c3b 100644
--- a/debian/ntpdate-debian
+++ b/debian/ntpdate-debian
@@ -8,7 +8,7 @@ fi
 
 if [ "$NTPDATE_USE_NTP_CONF" = yes ]; then
 	for f in /var/lib/ntp/ntp.conf.dhcp /etc/ntp.conf /etc/openntpd/ntpd.conf; do
-		if [ -r "$f" ]; then
+		if [ -r "$f" ] && [ -s "$f" ]; then
 			file=$f
 			break
 		fi
diff --git a/debian/ntpdate.default b/debian/ntpdate.default
index 3241694..f239b18 100644
--- a/debian/ntpdate.default
+++ b/debian/ntpdate.default
@@ -7,7 +7,7 @@ NTPDATE_USE_NTP_CONF=yes
 
 # List of NTP servers to use  (Separate multiple servers with spaces.)
 # Not used if NTPDATE_USE_NTP_CONF is yes.
-NTPSERVERS="0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org"
+NTPSERVERS="ntp.ubuntu.com"
 
 # Additional options to pass to ntpdate
 NTPOPTIONS=""
diff --git a/debian/ntpdate.if-up b/debian/ntpdate.if-up
index 8bd08b3..5271d4f 100644
--- a/debian/ntpdate.if-up
+++ b/debian/ntpdate.if-up
@@ -39,6 +39,14 @@ if [ -x /usr/bin/lockfile-create ]; then
 	LOCKTOUCHPID="$!"
 fi
 
+if [ -e /usr/sbin/openntpd ]; then
+    service='openntpd'
+else
+    service='ntp'
+fi
+
+invoke-rc.d --quiet $service stop >/dev/null 2>&1 || true
+
 /usr/sbin/ntpdate-debian -s $OPTS 2>/dev/null || :
 
 if [ -x /usr/bin/lockfile-create ] ; then
@@ -46,4 +54,6 @@ if [ -x /usr/bin/lockfile-create ] ; then
 	lockfile-remove $LOCKFILE
 fi
 
+invoke-rc.d --quiet $service start >/dev/null 2>&1 || true
+
 ) &
diff --git a/debian/patches/CVE-2014-9293.patch b/debian/patches/CVE-2014-9293.patch
 new file mode 100644
index 0000000..2775e99
--- /dev/null
+++ b/debian/patches/CVE-2014-9293.patch
@@ -0,0 +1,42 @@
+Description: fix weak default key in config_auth()
+Author: thanks to Red Hat
+Origin: vendor, https://git.centos.org/blob/rpms!ntp.git/c054b85192ea340529fc9a659cac7ea6b893b50e/SOURCES!ntp-4.2.6p5-cve-2014-9293.patch
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2665
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_config.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_config.c	2014-12-19 19:55:14.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_config.c	2014-12-20 05:45:33.818645887 -0500
+@@ -1866,13 +1866,16 @@
+ 		req_hashlen = digest_len;
+ #endif
+ 	} else {
+-		int	rankey;
++		unsigned char rankey[16];
++
++		if (ntp_crypto_random_buf(rankey, sizeof (rankey))) {
++			msyslog(LOG_ERR, "ntp_crypto_random_buf() failed.");
++			exit(1);
++		}
+ 
+-		rankey = ntp_random();
+ 		req_keytype = NID_md5;
+ 		req_hashlen = 16;
+-		MD5auth_setkey(req_keyid, req_keytype,
+-		    (u_char *)&rankey, sizeof(rankey));
++		MD5auth_setkey(req_keyid, req_keytype, rankey, sizeof(rankey));
+ 		authtrust(req_keyid, 1);
+ 	}
+ 
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntpd.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntpd.c	2014-12-19 19:55:14.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntpd.c	2014-12-20 05:45:33.818645887 -0500
+@@ -597,6 +597,7 @@
+ 	get_systime(&now);
+ 
+ 	ntp_srandom((int)(now.l_i * now.l_uf));
++	ntp_crypto_srandom();
+ 
+ #if !defined(VMS)
+ # ifndef NODETACH
diff --git a/debian/patches/CVE-2014-9294.patch b/debian/patches/CVE-2014-9294.patch
 new file mode 100644
index 0000000..052cc8d
--- /dev/null
+++ b/debian/patches/CVE-2014-9294.patch
@@ -0,0 +1,118 @@
+Description: fix non-cryptographic random number generator with weak
+ seed used by ntp-keygen to generate symmetric keys
+Author: thanks to Red Hat for backport
+Origin: vendor, https://git.centos.org/blob/rpms!ntp.git/c054b85192ea340529fc9a659cac7ea6b893b50e/SOURCES!ntp-4.2.6p5-cve-2014-9294.patch
+Origin: backport, http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548db6ddlELn4rnqUZ4kKGOjvtXwbQ
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2666
+
+Index: ntp-4.2.6.p5+dfsg/include/ntp_random.h
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/include/ntp_random.h	2009-12-09 02:36:35.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/include/ntp_random.h	2014-12-20 05:46:18.807038967 -0500
+@@ -1,6 +1,9 @@
+ 
+ #include <ntp_types.h>
+ 
++void ntp_crypto_srandom(void);
++int ntp_crypto_random_buf(void *buf, size_t nbytes);
++
+ long ntp_random (void);
+ void ntp_srandom (unsigned long);
+ void ntp_srandomdev (void);
+Index: ntp-4.2.6.p5+dfsg/libntp/ntp_random.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/libntp/ntp_random.c	2009-12-09 02:36:36.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/libntp/ntp_random.c	2014-12-20 05:46:18.807038967 -0500
+@@ -481,3 +481,63 @@
+ 	}
+ 	return(i);
+ }
++
++/*
++ * Crypto-quality random number functions
++ *
++ * Author: Harlan Stenn, 2014
++ *
++ * This file is Copyright (c) 2014 by Network Time Foundation.
++ * BSD terms apply: see the file COPYRIGHT in the distribution root for details.
++ */
++
++#include <openssl/err.h>
++#include <openssl/rand.h>
++
++int crypto_rand_init = 0;
++
++/*
++ * ntp_crypto_srandom:
++ *
++ * Initialize the random number generator, if needed by the underlying
++ * crypto random number generation mechanism.
++ */
++
++void
++ntp_crypto_srandom(
++	void
++	)
++{
++	if (!crypto_rand_init) {
++		RAND_poll();
++		crypto_rand_init = 1;
++	}
++}
++
++/*
++ * ntp_crypto_random_buf:
++ *
++ * Returns 0 on success, -1 on error.
++ */
++int
++ntp_crypto_random_buf(
++	void *buf,
++	size_t nbytes
++	)
++{
++	int rc;
++
++	rc = RAND_bytes(buf, nbytes);
++	if (1 != rc) {
++		unsigned long err;
++		char *err_str;
++
++		err = ERR_get_error();
++		err_str = ERR_error_string(err, NULL);
++		/* XXX: Log the error */
++
++		return -1;
++	}
++	return 0;
++}
++
+Index: ntp-4.2.6.p5+dfsg/util/ntp-keygen.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/util/ntp-keygen.c	2011-12-24 18:27:16.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/util/ntp-keygen.c	2014-12-20 05:46:18.811039002 -0500
+@@ -261,6 +261,8 @@
+ 	ssl_check_version();
+ #endif /* OPENSSL */
+ 
++	ntp_crypto_srandom();
++
+ 	/*
+ 	 * Process options, initialize host name and timestamp.
+ 	 */
+@@ -727,7 +729,14 @@
+ 			int temp;
+ 
+ 			while (1) {
+-				temp = ntp_random() & 0xff;
++				int rc;
++
++				rc = ntp_crypto_random_buf(&temp, 1);
++				if (-1 == rc) {
++					fprintf(stderr, "ntp_crypto_random_buf() failed.\n");
++					exit (-1);
++				}
++				temp &= 0xff;
+ 				if (temp == '#')
+ 					continue;
+ 
diff --git a/debian/patches/CVE-2014-9295.patch b/debian/patches/CVE-2014-9295.patch
 new file mode 100644
index 0000000..97b12cb
--- /dev/null
+++ b/debian/patches/CVE-2014-9295.patch
@@ -0,0 +1,108 @@
+Description: fix buffer overflows in crypto_recv(), ctl_putdata(), configure()
+Origin: backport, http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA
+Origin: backport, http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg
+Origin: backport, http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acf55dxKfhb6MuYQwzu8eDlS97g
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2667
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2668
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2669
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_control.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_control.c	2014-12-20 05:46:26.695107896 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_control.c	2014-12-20 05:46:40.583228864 -0500
+@@ -486,6 +486,10 @@
+ static	char *reqpt;
+ static	char *reqend;
+ 
++#ifndef MIN
++#define MIN(a, b) (((a) <= (b)) ? (a) : (b))
++#endif
++
+ /*
+  * init_control - initialize request data
+  */
+@@ -995,6 +999,7 @@
+ 	)
+ {
+ 	int overhead;
++	unsigned int currentlen;
+ 
+ 	overhead = 0;
+ 	if (!bin) {
+@@ -1018,12 +1023,22 @@
+ 	/*
+ 	 * Save room for trailing junk
+ 	 */
+-	if (dlen + overhead + datapt > dataend) {
++	while (dlen + overhead + datapt > dataend) {
+ 		/*
+ 		 * Not enough room in this one, flush it out.
+ 		 */
++		currentlen = MIN(dlen, dataend - datapt);
++
++		memcpy(datapt, dp, currentlen);
++
++		datapt += currentlen;
++		dp += currentlen;
++		dlen -= currentlen;
++		datalinelen += currentlen;
++
+ 		ctl_flushpkt(CTL_MORE);
+ 	}
++
+ 	memmove((char *)datapt, dp, (unsigned)dlen);
+ 	datapt += dlen;
+ 	datalinelen += dlen;
+@@ -2492,6 +2507,20 @@
+ 
+ 	/* Initialize the remote config buffer */
+ 	data_count = reqend - reqpt;
++
++	if (data_count > sizeof(remote_config.buffer) - 2) {
++		snprintf(remote_config.err_msg,
++			 sizeof(remote_config.err_msg),
++			 "runtime configuration failed: request too long");
++		ctl_putdata(remote_config.err_msg,
++			    strlen(remote_config.err_msg), 0);
++		ctl_flushpkt(0);
++		msyslog(LOG_NOTICE,
++			"runtime config from %s rejected: request too long",
++			stoa(&rbufp->recv_srcadr));
++		return;
++	}
++
+ 	memcpy(remote_config.buffer, reqpt, data_count);
+ 	if (data_count > 0
+ 	    && '\n' != remote_config.buffer[data_count - 1])
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_crypto.c	2011-11-30 21:55:17.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c	2014-12-20 05:46:40.579228829 -0500
+@@ -789,15 +789,24 @@
+ 			 * errors.
+ 			 */
+ 			if (vallen == (u_int)EVP_PKEY_size(host_pkey)) {
++				u_int32 *cookiebuf = malloc(
++				    RSA_size(host_pkey->pkey.rsa));
++				if (!cookiebuf) {
++					rval = XEVNT_CKY;
++					break;
++				}
++
+ 				if (RSA_private_decrypt(vallen,
+ 				    (u_char *)ep->pkt,
+-				    (u_char *)&temp32,
++				    (u_char *)cookiebuf,
+ 				    host_pkey->pkey.rsa,
+-				    RSA_PKCS1_OAEP_PADDING) <= 0) {
++				    RSA_PKCS1_OAEP_PADDING) != 4) {
+ 					rval = XEVNT_CKY;
++					free(cookiebuf);
+ 					break;
+ 				} else {
+-					cookie = ntohl(temp32);
++					cookie = ntohl(*cookiebuf);
++					free(cookiebuf);
+ 				}
+ 			} else {
+ 				rval = XEVNT_CKY;
diff --git a/debian/patches/CVE-2014-9296.patch b/debian/patches/CVE-2014-9296.patch
 new file mode 100644
index 0000000..0eb972c
--- /dev/null
+++ b/debian/patches/CVE-2014-9296.patch
@@ -0,0 +1,16 @@
+Description: fix missing return on error in receive()
+Origin: backport, http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548ad06feXHK1HlZoY-WZVyynwvwAg
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2670
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_proto.c	2011-12-08 21:00:53.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c	2014-12-20 05:47:01.139407818 -0500
+@@ -947,6 +947,7 @@
+ 				fast_xmit(rbufp, MODE_ACTIVE, 0,
+ 				    restrict_mask);
+ 				sys_restricted++;
++				return;
+ 			}
+ 		}
+ 
diff --git a/debian/patches/CVE-2014-9297.patch b/debian/patches/CVE-2014-9297.patch
 new file mode 100644
index 0000000..b367d81
--- /dev/null
+++ b/debian/patches/CVE-2014-9297.patch
@@ -0,0 +1,371 @@
+Description: fix denial of service and possible info leakage via
+ extension fields
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=5492d353ncauuWt_PONxaDhC5Qv_SA
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54a7c595jlwS3KmAxBML75HFGLR_pQ
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54abb266In81wLNAqIaovtP8f2UmUw
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2671
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_crypto.c	2015-02-06 07:58:50.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c	2015-02-06 08:44:08.207402853 -0500
+@@ -109,6 +109,7 @@
+ #define TAI_1972	10	/* initial TAI offset (s) */
+ #define MAX_LEAP	100	/* max UTC leapseconds (s) */
+ #define VALUE_LEN	(6 * 4) /* min response field length */
++#define MAX_VALLEN	(65535 - VALUE_LEN)
+ #define YEAR		(60 * 60 * 24 * 365) /* seconds in year */
+ 
+ /*
+@@ -147,8 +148,8 @@
+  */
+ static	int	crypto_verify	(struct exten *, struct value *,
+ 				    struct peer *);
+-static	int	crypto_encrypt	(struct exten *, struct value *,
+-				    keyid_t *);
++static	int	crypto_encrypt	(const u_char *, u_int, keyid_t *,
++				    struct value *);
+ static	int	crypto_alice	(struct peer *, struct value *);
+ static	int	crypto_alice2	(struct peer *, struct value *);
+ static	int	crypto_alice3	(struct peer *, struct value *);
+@@ -444,6 +445,12 @@
+ 			tstamp = ntohl(ep->tstamp);
+ 			fstamp = ntohl(ep->fstamp);
+ 			vallen = ntohl(ep->vallen);
++			/*
++			 * Bug 2761: I hope this isn't too early...
++			 */
++			if (   vallen == 0
++			    || len - VALUE_LEN < vallen)
++				return XEVNT_LEN;
+ 		}
+ 		switch (code) {
+ 
+@@ -494,8 +501,9 @@
+ 					rval = XEVNT_ERR;
+ 				break;
+ 			}
++			INSIST(len >= VALUE_LEN);
+ 			if (vallen == 0 || vallen > MAXHOSTNAME ||
+-			    len < VALUE_LEN + vallen) {
++			    len - VALUE_LEN < vallen) {
+ 				rval = XEVNT_LEN;
+ 				break;
+ 			}
+@@ -1162,8 +1170,9 @@
+ 	 * choice. 
+ 	 */
+ 	case CRYPTO_CERT | CRYPTO_RESP:
+-		vallen = ntohl(ep->vallen);
+-		if (vallen == 0 || vallen > MAXHOSTNAME) {
++		vallen = ntohl(ep->vallen);	/* Must be <64k */
++		if (vallen == 0 || vallen > MAXHOSTNAME ||
++		    len - VALUE_LEN < vallen) {
+ 			rval = XEVNT_LEN;
+ 			break;
+ 
+@@ -1315,7 +1324,10 @@
+ 	 * anything goes wrong.
+ 	 */
+ 	case CRYPTO_COOK | CRYPTO_RESP:
+-		if ((opcode & 0xffff) < VALUE_LEN) {
++		vallen = ntohl(ep->vallen);	/* Must be <64k */
++		if (   vallen == 0
++		    || (vallen >= MAX_VALLEN)
++		    || (opcode & 0x0000ffff)  < VALUE_LEN + vallen) {
+ 			rval = XEVNT_LEN;
+ 			break;
+ 		}
+@@ -1323,8 +1335,8 @@
+ 			tcookie = cookie;
+ 		else
+ 			tcookie = peer->hcookie;
+-		if ((rval = crypto_encrypt(ep, &vtemp, &tcookie)) ==
+-		    XEVNT_OK) {
++		if ((rval = crypto_encrypt((const u_char *)ep->pkt, vallen, &tcookie, &vtemp))
++		    == XEVNT_OK) {
+ 			len = crypto_send(fp, &vtemp, start);
+ 			value_free(&vtemp);
+ 		}
+@@ -1464,13 +1476,16 @@
+ 	 * up to the next word (4 octets).
+ 	 */
+ 	vallen = ntohl(ep->vallen);
+-	if (vallen == 0)
++	if (   vallen == 0
++	    || vallen > MAX_VALLEN)
+ 		return (XEVNT_LEN);
+ 
+ 	i = (vallen + 3) / 4;
+ 	siglen = ntohl(ep->pkt[i++]);
+-	if (len < VALUE_LEN + ((vallen + 3) / 4) * 4 + ((siglen + 3) /
+-	    4) * 4)
++	if (   siglen > MAX_VALLEN
++	    || len - VALUE_LEN < ((vallen + 3) / 4) * 4
++	    || len - VALUE_LEN - ((vallen + 3) / 4) * 4
++	      < ((siglen + 3) / 4) * 4)
+ 		return (XEVNT_LEN);
+ 
+ 	/*
+@@ -1528,6 +1543,7 @@
+ 	 * proventic bit. What a relief.
+ 	 */
+ 	EVP_VerifyInit(&ctx, peer->digest);
++	/* XXX: the "+ 12" needs to be at least documented... */
+ 	EVP_VerifyUpdate(&ctx, (u_char *)&ep->tstamp, vallen + 12);
+ 	if (EVP_VerifyFinal(&ctx, (u_char *)&ep->pkt[i], siglen,
+ 	    pkey) <= 0)
+@@ -1540,34 +1556,31 @@
+ 
+ 
+ /*
+- * crypto_encrypt - construct encrypted cookie and signature from
+- * extension field and cookie
++ * crypto_encrypt - construct vp (encrypted cookie and signature) from
++ * the public key and cookie.
+  *
+- * Returns
++ * Returns:
+  * XEVNT_OK	success
+  * XEVNT_CKY	bad or missing cookie
+  * XEVNT_PUB	bad or missing public key
+  */
+ static int
+ crypto_encrypt(
+-	struct exten *ep,	/* extension pointer */
+-	struct value *vp,	/* value pointer */
+-	keyid_t	*cookie		/* server cookie */
++	const u_char *ptr,	/* Public Key */
++	u_int	vallen,		/* Length of Public Key */
++	keyid_t	*cookie,	/* server cookie */
++	struct value *vp	/* value pointer */
+ 	)
+ {
+ 	EVP_PKEY *pkey;		/* public key */
+ 	EVP_MD_CTX ctx;		/* signature context */
+ 	tstamp_t tstamp;	/* NTP timestamp */
+ 	u_int32	temp32;
+-	u_int	len;
+-	u_char	*ptr;
+ 
+ 	/*
+ 	 * Extract the public key from the request.
+ 	 */
+-	len = ntohl(ep->vallen);
+-	ptr = (u_char *)ep->pkt;
+-	pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, len);
++	pkey = d2i_PublicKey(EVP_PKEY_RSA, NULL, &ptr, vallen);
+ 	if (pkey == NULL) {
+ 		msyslog(LOG_ERR, "crypto_encrypt: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+@@ -1581,9 +1594,9 @@
+ 	tstamp = crypto_time();
+ 	vp->tstamp = htonl(tstamp);
+ 	vp->fstamp = hostval.tstamp;
+-	len = EVP_PKEY_size(pkey);
+-	vp->vallen = htonl(len);
+-	vp->ptr = emalloc(len);
++	vallen = EVP_PKEY_size(pkey);
++	vp->vallen = htonl(vallen);
++	vp->ptr = emalloc(vallen);
+ 	ptr = vp->ptr;
+ 	temp32 = htonl(*cookie);
+ 	if (RSA_public_encrypt(4, (u_char *)&temp32, ptr,
+@@ -1601,8 +1614,8 @@
+ 	vp->sig = emalloc(sign_siglen);
+ 	EVP_SignInit(&ctx, sign_digest);
+ 	EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12);
+-	EVP_SignUpdate(&ctx, vp->ptr, len);
+-	if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey))
++	EVP_SignUpdate(&ctx, vp->ptr, vallen);
++	if (EVP_SignFinal(&ctx, vp->sig, &vallen, sign_pkey))
+ 		vp->siglen = htonl(sign_siglen);
+ 	return (XEVNT_OK);
+ }
+@@ -1673,6 +1686,9 @@
+  * call in the protocol module.
+  *
+  * Returns extension field pointer (no errors)
++ *
++ * XXX: opcode and len should really be 32-bit quantities and
++ * we should make sure that str is not too big.
+  */
+ struct exten *
+ crypto_args(
+@@ -1685,24 +1701,31 @@
+ 	tstamp_t tstamp;	/* NTP timestamp */
+ 	struct exten *ep;	/* extension field pointer */
+ 	u_int	len;		/* extension field length */
++	size_t	slen;
+ 
+ 	tstamp = crypto_time();
+ 	len = sizeof(struct exten);
+-	if (str != NULL)
+-		len += strlen(str);
++	if (str != NULL) {
++		slen = strlen(str);
++		INSIST(slen < MAX_VALLEN);
++		len += slen;
++	}
+ 	ep = emalloc(len);
+ 	memset(ep, 0, len);
+ 	if (opcode == 0)
+ 		return (ep);
+ 
++	REQUIRE(0 == (len    & ~0x0000ffff));
++	REQUIRE(0 == (opcode & ~0xffff0000));
++
+ 	ep->opcode = htonl(opcode + len);
+ 	ep->associd = htonl(associd);
+ 	ep->tstamp = htonl(tstamp);
+ 	ep->fstamp = hostval.tstamp;
+ 	ep->vallen = 0;
+ 	if (str != NULL) {
+-		ep->vallen = htonl(strlen(str));
+-		memcpy((char *)ep->pkt, str, strlen(str));
++		ep->vallen = htonl(slen);
++		memcpy((char *)ep->pkt, str, slen);
+ 	}
+ 	return (ep);
+ }
+@@ -1715,6 +1738,8 @@
+  * Note: it is not polite to send a nonempty signature with zero
+  * timestamp or a nonzero timestamp with an empty signature, but those
+  * rules are not enforced here.
++ *
++ * XXX This code won't work on a box with 16-bit ints.
+  */
+ int
+ crypto_send(
+@@ -1730,8 +1755,9 @@
+ 	 * Calculate extension field length and check for buffer
+ 	 * overflow. Leave room for the MAC.
+ 	 */
+-	len = 16;
++	len = 16;				/* XXX Document! */
+ 	vallen = ntohl(vp->vallen);
++	INSIST(vallen <= MAX_VALLEN);
+ 	len += ((vallen + 3) / 4 + 1) * 4; 
+ 	siglen = ntohl(vp->siglen);
+ 	len += ((siglen + 3) / 4 + 1) * 4; 
+@@ -1772,6 +1798,7 @@
+ 	}
+ 	opcode = ntohl(ep->opcode);
+ 	ep->opcode = htonl((opcode & 0xffff0000) | len); 
++	ENSURE(len <= MAX_VALLEN);
+ 	return (len);
+ }
+ 
+@@ -1807,7 +1834,6 @@
+ 	if (hostval.tstamp == 0)
+ 		return;
+ 
+-
+ 	/*
+ 	 * Sign public key and timestamps. The filestamp is derived from
+ 	 * the host key file extension from wherever the file was
+@@ -2108,7 +2134,8 @@
+ 	tstamp_t tstamp;	/* NTP timestamp */
+ 	BIGNUM	*bn, *bk, *r;
+ 	u_char	*ptr;
+-	u_int	len;
++	u_int	len;		/* extension field length */
++	u_int	vallen = 0;	/* value length */
+ 
+ 	/*
+ 	 * If the IFF parameters are not valid, something awful
+@@ -2123,8 +2150,11 @@
+ 	/*
+ 	 * Extract r from the challenge.
+ 	 */
+-	len = ntohl(ep->vallen);
+-	if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
++	vallen = ntohl(ep->vallen);
++	len = ntohl(ep->opcode) & 0x0000ffff;
++	if (vallen == 0 || len < VALUE_LEN || len - VALUE_LEN < vallen)
++		return XEVNT_LEN;
++	if ((r = BN_bin2bn((u_char *)ep->pkt, vallen, NULL)) == NULL) {
+ 		msyslog(LOG_ERR, "crypto_bob: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+ 		return (XEVNT_ERR);
+@@ -2136,7 +2166,7 @@
+ 	 */
+ 	bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new();
+ 	sdsa = DSA_SIG_new();
+-	BN_rand(bk, len * 8, -1, 1);		/* k */
++	BN_rand(bk, vallen * 8, -1, 1);		/* k */
+ 	BN_mod_mul(bn, dsa->priv_key, r, dsa->q, bctx); /* b r mod q */
+ 	BN_add(bn, bn, bk);
+ 	BN_mod(bn, bn, dsa->q, bctx);		/* k + b r mod q */
+@@ -2155,30 +2185,37 @@
+ 	 * Encode the values in ASN.1 and sign. The filestamp is from
+ 	 * the local file.
+ 	 */
+-	len = i2d_DSA_SIG(sdsa, NULL);
+-	if (len == 0) {
++	vallen = i2d_DSA_SIG(sdsa, NULL);
++	if (vallen == 0) {
+ 		msyslog(LOG_ERR, "crypto_bob: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+ 		DSA_SIG_free(sdsa);
+ 		return (XEVNT_ERR);
+ 	}
++	if (vallen > MAX_VALLEN) {
++		msyslog(LOG_ERR, "crypto_bob: signature is too big: %d",
++		    vallen);
++		DSA_SIG_free(sdsa);
++		return (XEVNT_LEN);
++	}
+ 	memset(vp, 0, sizeof(struct value));
+ 	tstamp = crypto_time();
+ 	vp->tstamp = htonl(tstamp);
+ 	vp->fstamp = htonl(iffkey_info->fstamp);
+-	vp->vallen = htonl(len);
+-	ptr = emalloc(len);
++	vp->vallen = htonl(vallen);
++	ptr = emalloc(vallen);
+ 	vp->ptr = ptr;
+ 	i2d_DSA_SIG(sdsa, &ptr);
+ 	DSA_SIG_free(sdsa);
+ 	if (tstamp == 0)
+ 		return (XEVNT_OK);
+ 
++	/* XXX: more validation to make sure the sign fits... */
+ 	vp->sig = emalloc(sign_siglen);
+ 	EVP_SignInit(&ctx, sign_digest);
+ 	EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12);
+-	EVP_SignUpdate(&ctx, vp->ptr, len);
+-	if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey))
++	EVP_SignUpdate(&ctx, vp->ptr, vallen);
++	if (EVP_SignFinal(&ctx, vp->sig, &vallen, sign_pkey))
+ 		vp->siglen = htonl(sign_siglen);
+ 	return (XEVNT_OK);
+ }
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_proto.c	2015-02-06 07:58:50.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c	2015-02-06 08:32:45.146114360 -0500
+@@ -431,7 +431,7 @@
+ 	 */
+ 	authlen = LEN_PKT_NOMAC;
+ 	has_mac = rbufp->recv_length - authlen;
+-	while (has_mac != 0) {
++	while (has_mac > 0) {
+ 		u_int32	len;
+ 
+ 		if (has_mac % 4 != 0 || has_mac < MIN_MAC_LEN) {
+@@ -456,6 +456,14 @@
+ 	}
+ 
+ 	/*
++	 * If has_mac is < 0 we had a malformed packet.
++	 */
++	if (has_mac < 0) {
++		sys_badlength++;
++		return;		/* bad length */
++	}
++
++	/*
+ 	 * If authentication required, a MAC must be present.
+ 	 */
+ 	if (restrict_mask & RES_DONTTRUST && has_mac == 0) {
diff --git a/debian/patches/CVE-2014-9298.patch b/debian/patches/CVE-2014-9298.patch
 new file mode 100644
index 0000000..6a5ea31
--- /dev/null
+++ b/debian/patches/CVE-2014-9298.patch
@@ -0,0 +1,43 @@
+Description: fix IPv6 ACL bypass
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54922b65gDSbE4G7c3JjkuK1Tv33qQ
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=5492d2879rotbnnuVch_ZC3RAfS8AA
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=5493f333hALqPcXLR4-76bC6j-16xQ
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=5496213frLaEz5PHLZVhuYjM7Lalkw
+Origin: upstream, http://bk1.ntp.org/ntp-stable/ntpd/ntp_io.c?PAGE=diffs&REV=54a0f621LdfQSkkWKUKN6PaFbH25_Q
+Origin: upstream, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54c2228bpOp4_zrX9aGXdMEZJEGzkg
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2672
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_io.c	2011-11-30 21:55:17.000000000 -0500
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c	2015-02-06 08:57:54.277845529 -0500
+@@ -3470,6 +3470,29 @@
+ 		    fd, buflen, stoa(&rb->recv_srcadr)));
+ 
+ 	/*
++	** Bug 2672: Some OSes (MacOSX and Linux) don't block spoofed ::1
++	*/
++
++	if (AF_INET6 == itf->family) {
++		DPRINTF(2, ("Got an IPv6 packet, from <%s> (%d) to <%s> (%d)\n",
++			stoa(&rb->recv_srcadr),
++			IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&rb->recv_srcadr)),
++			stoa(&itf->sin),
++			!IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&itf->sin))
++			));
++
++		if (   IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&rb->recv_srcadr))
++		    && !IN6_IS_ADDR_LOOPBACK(PSOCK_ADDR6(&itf->sin))
++		   ) {
++			packets_dropped++;
++			DPRINTF(2, ("DROPPING that packet\n"));
++			freerecvbuf(rb);
++			return buflen;
++		}
++		DPRINTF(2, ("processing that packet\n"));
++	}
++
++	/*
+ 	 * Got one.  Mark how and when it got here,
+ 	 * put it on the full list and do bookkeeping.
+ 	 */
diff --git a/debian/patches/CVE-2015-1798.patch b/debian/patches/CVE-2015-1798.patch
 new file mode 100644
index 0000000..1eb65ba
--- /dev/null
+++ b/debian/patches/CVE-2015-1798.patch
@@ -0,0 +1,33 @@
+Description: fix symmetric key unauthenticated packet MITM attack
+Origin: upstream, http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=550a80b0iGyIv4t9J1GJ_74V_eEx4A
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2779
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_proto.c	2015-04-07 12:47:11.000000000 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c	2015-04-07 12:47:56.583800918 -0400
+@@ -1131,18 +1121,20 @@
+ 		return;
+ 
+ 	/* 
+-	 * If the digest fails, the client cannot authenticate a server
++	 * If the digest fails or it's missing for authenticated
++	 * associations, the client cannot authenticate a server
+ 	 * reply to a client packet previously sent. The loopback check
+ 	 * is designed to avoid a bait-and-switch attack, which was
+ 	 * possible in past versions. If symmetric modes, return a
+ 	 * crypto-NAK. The peer should restart the protocol.
+ 	 */
+-	} else if (!AUTH(has_mac || (restrict_mask & RES_DONTTRUST),
+-	    is_authentic)) {
++	} else if (!AUTH(peer->keyid || has_mac ||
++			 (restrict_mask & RES_DONTTRUST), is_authentic)) {
+ 		report_event(PEVNT_AUTH, peer, "digest");
+ 		peer->flash |= TEST5;		/* bad auth */
+ 		peer->badauth++;
+-		if (hismode == MODE_ACTIVE || hismode == MODE_PASSIVE)
++		if (has_mac &&
++		    (hismode == MODE_ACTIVE || hismode == MODE_PASSIVE))
+ 			fast_xmit(rbufp, MODE_ACTIVE, 0, restrict_mask);
+ 		if (peer->flags & FLAG_PREEMPT) {
+ 			unpeer(peer);
diff --git a/debian/patches/CVE-2015-1799.patch b/debian/patches/CVE-2015-1799.patch
 new file mode 100644
index 0000000..4882970
--- /dev/null
+++ b/debian/patches/CVE-2015-1799.patch
@@ -0,0 +1,42 @@
+Description: fix symmetric association DoS attack
+Origin: upstream, http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=550a80b0iGyIv4t9J1GJ_74V_eEx4A
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2781
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_proto.c	2015-04-07 12:52:45.538476188 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c	2015-04-07 12:52:45.534476151 -0400
+@@ -1102,16 +1102,6 @@
+ 	}
+ 
+ 	/*
+-	 * Update the state variables.
+-	 */
+-	if (peer->flip == 0) {
+-		if (hismode != MODE_BROADCAST)
+-			peer->rec = p_xmt;
+-		peer->dst = rbufp->recv_time;
+-	}
+-	peer->xmt = p_xmt;
+-
+-	/*
+ 	 * If this is a crypto_NAK, the server cannot authenticate a
+ 	 * client packet. The server might have just changed keys. Clear
+ 	 * the association and restart the protocol.
+@@ -1158,6 +1148,16 @@
+ 	}
+ 
+ 	/*
++	 * Update the state variables.
++	 */
++	if (peer->flip == 0) {
++		if (hismode != MODE_BROADCAST)
++			peer->rec = p_xmt;
++		peer->dst = rbufp->recv_time;
++	}
++	peer->xmt = p_xmt;
++
++	/*
+ 	 * Set the peer ppoll to the maximum of the packet ppoll and the
+ 	 * peer minpoll. If a kiss-o'-death, set the peer minpoll to
+ 	 * this maximumn and advance the headway to give the sender some
diff --git a/debian/patches/CVE-2015-5146.patch b/debian/patches/CVE-2015-5146.patch
 new file mode 100644
index 0000000..a6a05af
--- /dev/null
+++ b/debian/patches/CVE-2015-5146.patch
@@ -0,0 +1,128 @@
+Backport of:
+
+From c3e7afb9cd88784c6b4f81182bd878fc3a2d23a1 Mon Sep 17 00:00:00 2001
+From:  <jnperlin@hydra.(none)>
+Date: Wed, 24 Jun 2015 09:18:52 +0200
+Subject: [PATCH] Bug 2853 - FICORA #829967
+
+---
+ ChangeLog          |  1 +
+ ntpd/ntp_control.c | 77 +++++++++++++++++++++++++++++++++++++++---------------
+ 2 files changed, 57 insertions(+), 21 deletions(-)
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_control.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_control.c	2015-10-23 08:51:25.428716718 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_control.c	2015-10-23 08:53:11.285800571 -0400
+@@ -2471,6 +2471,35 @@
+ 	ctl_flushpkt(0);
+ }
+ 
++/* Bug 2853 */
++/* evaluate the length of the command sequence. This breaks at the first
++ * char that is not >= SPACE and <= 127 after trimming from the right.
++ */
++static size_t
++cmdlength(
++	const char *src_buf,
++	const char *src_end
++	)
++{
++	const char *scan;
++	unsigned char ch;
++
++	/* trim whitespace & garbage from the right */
++	while (src_end != src_buf) {
++		ch = src_end[-1];
++		if (ch > ' ' && ch < 128)
++			break;
++		--src_end;
++	}
++	/* now do a forward scan */
++	for (scan = src_buf; scan != src_end; ++scan) {
++		ch = scan[0];
++		if ((ch < ' ' || ch >= 128) && ch != '\t')
++			break;
++	}
++	return (size_t)(scan - src_buf);
++}
++
+ /*
+  * configure() processes ntpq :config/config-from-file, allowing
+  *		generic runtime reconfiguration.
+@@ -2482,7 +2511,6 @@
+ {
+ 	size_t data_count;
+ 	int retval;
+-	int replace_nl;
+ 
+ 	/* I haven't yet implemented changes to an existing association.
+ 	 * Hence check if the association id is 0
+@@ -2506,7 +2534,7 @@
+ 	}
+ 
+ 	/* Initialize the remote config buffer */
+-	data_count = reqend - reqpt;
++	data_count = cmdlength(reqpt, reqend);
+ 
+ 	if (data_count > sizeof(remote_config.buffer) - 2) {
+ 		snprintf(remote_config.err_msg,
+@@ -2520,32 +2548,41 @@
+ 			stoa(&rbufp->recv_srcadr));
+ 		return;
+ 	}
++	/* Bug 2853 -- check if all characters were acceptable */
++	if (data_count != (size_t)(reqend - reqpt)) {
++		snprintf(remote_config.err_msg,
++			 sizeof(remote_config.err_msg),
++			 "runtime configuration failed: request contains an unprintable character");
++		ctl_putdata(remote_config.err_msg,
++			    strlen(remote_config.err_msg), 0);
++		ctl_flushpkt(0);
++		msyslog(LOG_NOTICE,
++			"runtime config from %s rejected: request contains an unprintable character: %0x",
++			stoa(&rbufp->recv_srcadr),
++			reqpt[data_count]);
++		return;
++	}
+ 
+ 	memcpy(remote_config.buffer, reqpt, data_count);
+-	if (data_count > 0
+-	    && '\n' != remote_config.buffer[data_count - 1])
+-		remote_config.buffer[data_count++] = '\n';
++	/* The buffer has no trailing linefeed or NUL right now. For
++	 * logging, we do not want a newline, so we do that first after
++	 * adding the necessary NUL byte.
++	 */
+ 	remote_config.buffer[data_count] = '\0';
+-	remote_config.pos = 0;
+-	remote_config.err_pos = 0;
+-	remote_config.no_errors = 0;
+-
+-	/* do not include terminating newline in log */
+-	if (data_count > 0
+-	    && '\n' == remote_config.buffer[data_count - 1]) {
+-		remote_config.buffer[data_count - 1] = '\0';
+-		replace_nl = 1;
+-	} else
+-		replace_nl = 0;
+-
+ 	DPRINTF(1, ("Got Remote Configuration Command: %s\n",
+ 		remote_config.buffer));
+ 	msyslog(LOG_NOTICE, "%s config: %s",
+ 		stoa(&rbufp->recv_srcadr),
+ 		remote_config.buffer);
+ 
+-	if (replace_nl)
+-		remote_config.buffer[data_count - 1] = '\n';
++	/* Now we have to make sure there is a NL/NUL sequence at the
++	 * end of the buffer before we parse it.
++	 */
++	remote_config.buffer[data_count++] = '\n';
++	remote_config.buffer[data_count] = '\0';
++	remote_config.pos = 0;
++	remote_config.err_pos = 0;
++	remote_config.no_errors = 0;
+ 
+ 	config_remotely(&rbufp->recv_srcadr);
+ 
diff --git a/debian/patches/CVE-2015-5194.patch b/debian/patches/CVE-2015-5194.patch
 new file mode 100644
index 0000000..2938aa2
--- /dev/null
+++ b/debian/patches/CVE-2015-5194.patch
@@ -0,0 +1,49 @@
+Backport of:
+
+From 553f2fa65865c31c5e3c48812cfd46176cffdd27 Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Wed, 28 Jul 2010 05:33:53 +0000
+Subject: [PATCH] [Bug 1593] ntpd abort in free() with logconfig syntax error.
+
+---
+ ChangeLog         |   1 +
+ ntpd/ntp_parser.c | 114 +++++++++++++++++++++++++++++-------------------------
+ ntpd/ntp_parser.y |  24 ++++++++----
+ 3 files changed, 80 insertions(+), 59 deletions(-)
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_parser.y
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_parser.y	2015-10-22 15:04:36.368602522 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_parser.y	2015-10-22 15:04:36.368602522 -0400
+@@ -1037,14 +1037,24 @@
+ log_config_command
+ 	:	T_String
+ 		{
+-			char prefix = $1[0];
+-			char *type = $1 + 1;
++			char	prefix;
++			char *	type;
+ 			
+-			if (prefix != '+' && prefix != '-' && prefix != '=') {
+-				yyerror("Logconfig prefix is not '+', '-' or '='\n");
+-			}
+-			else
+-				$$ = create_attr_sval(prefix, estrdup(type));
++			switch ($1[0]) {
++			
++			case '+':
++			case '-':
++			case '=':
++				prefix = $1[0];
++				type = $1 + 1;
++				break;
++				
++			default:
++				prefix = '=';
++				type = $1;
++			}	
++			
++			$$ = create_attr_sval(prefix, estrdup(type));
+ 			YYFREE($1);
+ 		}
+ 	;
diff --git a/debian/patches/CVE-2015-5195.patch b/debian/patches/CVE-2015-5195.patch
 new file mode 100644
index 0000000..507ffb4
--- /dev/null
+++ b/debian/patches/CVE-2015-5195.patch
@@ -0,0 +1,47 @@
+Backport of:
+
+From 52e977d79a0c4ace997e5c74af429844da2f27be Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Thu, 6 Jan 2011 04:02:24 +0000
+Subject: [PATCH] [Bug 1773] openssl not detected during ./configure. [Bug
+ 1774] Segfaults if cryptostats enabled and built without OpenSSL.
+
+---
+ ChangeLog         |  2 ++
+ m4/ntp_openssl.m4 | 38 ++++++++++++++++----------------------
+ ntpd/ntp_config.c | 12 ++++++++++++
+ ntpd/ntp_util.c   | 12 ++----------
+ 4 files changed, 32 insertions(+), 32 deletions(-)
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_config.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_config.c	2015-10-22 15:07:29.534321900 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_config.c	2015-10-22 15:12:42.233434208 -0400
+@@ -2022,6 +2022,13 @@
+ 	while (pfilegen_token != NULL) {
+ 		filegen_string = keyword(*pfilegen_token);
+ 		filegen = filegen_get(filegen_string);
++		if (NULL == filegen) {
++			msyslog(LOG_ERR,
++				"stats %s unrecognized",
++				filegen_string);
++			pfilegen_token = next_node(pfilegen_token);
++			continue;
++		}
+ 
+ 		DPRINTF(4, ("enabling filegen for %s statistics '%s%s'\n",
+ 			    filegen_string, filegen->prefix, 
+@@ -2035,6 +2042,13 @@
+ 	while (my_node != NULL) {
+ 		filegen_file = keyword(my_node->filegen_token);
+ 		filegen = filegen_get(filegen_file);
++		if (NULL == filegen) {
++			msyslog(LOG_ERR,
++				"filegen category '%s' unrecognized",
++				filegen_file);
++			my_node = next_node(my_node);
++			continue;
++		}
+ 
+ 		/* Initialize the filegen variables to their pre-configurtion states */
+ 		filegen_flag = filegen->flag;
diff --git a/debian/patches/CVE-2015-5196.patch b/debian/patches/CVE-2015-5196.patch
 new file mode 100644
index 0000000..2f7714a
--- /dev/null
+++ b/debian/patches/CVE-2015-5196.patch
@@ -0,0 +1,57 @@
+Description: fix file overwrite via remote pidfile and driftfile
+ configuration directives
+Origin: vendor, http://pkgs.fedoraproject.org/cgit/ntp.git/tree/ntp-4.2.6p5-cve-2015-5196.patch
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_parser.y
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_parser.y	2015-10-22 15:55:22.498495669 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_parser.y	2015-10-22 15:55:22.498495669 -0400
+@@ -988,23 +988,43 @@
+ 
+ misc_cmd_str_keyword
+ 	:	T_Leapfile
+-	|	T_Pidfile
+ 	|	T_Qos
+ 	;
+ 
+ misc_cmd_str_lcl_keyword
+ 	:	T_Logfile
++	|	T_Pidfile
+ 	|	T_Saveconfigdir
+ 	;
+ 
+ drift_parm
+ 	:	T_String
+-			{ enqueue(cfgt.vars, create_attr_sval(T_Driftfile, $1)); }
++		{
++			if (input_from_file) {
++				enqueue(cfgt.vars, create_attr_sval(T_Driftfile, $1));
++			} else {
++				YYFREE($1);
++				yyerror("driftfile remote configuration ignored");
++			}
++		}
+ 	|	T_String T_Double
+-			{ enqueue(cfgt.vars, create_attr_dval(T_WanderThreshold, $2));
+-			  enqueue(cfgt.vars, create_attr_sval(T_Driftfile, $1)); }
++		{
++			if (input_from_file) {
++				enqueue(cfgt.vars, create_attr_dval(T_WanderThreshold, $2));
++				enqueue(cfgt.vars, create_attr_sval(T_Driftfile, $1));
++			} else {
++				YYFREE($1);
++				yyerror("driftfile remote configuration ignored");
++			}
++		}
+ 	|	/* Null driftfile,  indicated by null string "\0" */
+-			{ enqueue(cfgt.vars, create_attr_sval(T_Driftfile, "\0")); }
++		{
++			if (input_from_file) {
++				enqueue(cfgt.vars, create_attr_sval(T_Driftfile, estrdup("")));
++			} else {
++				yyerror("driftfile remote configuration ignored");
++			}
++		}
+ 	;
+ 
+ variable_assign
diff --git a/debian/patches/CVE-2015-5219.patch b/debian/patches/CVE-2015-5219.patch
 new file mode 100644
index 0000000..35a651e
--- /dev/null
+++ b/debian/patches/CVE-2015-5219.patch
@@ -0,0 +1,27 @@
+From 5f295cd05c3c136d39f5b3e500a2d781bdbb59c8 Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Wed, 24 Apr 2013 19:13:53 -0400
+Subject: [PATCH] [Bug 2382] Implement LOGTOD using ldexp() instead of shifting
+
+---
+ ChangeLog     | 1 +
+ include/ntp.h | 5 ++---
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+Index: ntp-4.2.6.p5+dfsg/include/ntp.h
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/include/ntp.h	2015-10-22 15:17:12.632029576 -0400
++++ ntp-4.2.6.p5+dfsg/include/ntp.h	2015-10-22 15:17:12.632029576 -0400
+@@ -163,10 +163,9 @@
+ #define SQUARE(x) ((x) * (x))
+ #define SQRT(x) (sqrt(x))
+ #define DIFF(x, y) (SQUARE((x) - (y)))
+-#define LOGTOD(a)	((a) < 0 ? 1. / (1L << -(a)) : \
+-			    1L << (int)(a)) /* log2 to double */
++#define LOGTOD(a)	ldexp(1., (int)(a)) /* log2 to double */
+ #define UNIVAR(x)	(SQUARE(.28867513 * LOGTOD(x))) /* std uniform distr */
+-#define ULOGTOD(a)	(1L << (int)(a)) /* ulog2 to double */
++#define ULOGTOD(a)	ldexp(1., (int)(a)) /* ulog2 to double */
+ 
+ #define	EVENT_TIMEOUT	0	/* one second, that is */
+ 
diff --git a/debian/patches/CVE-2015-5300.patch b/debian/patches/CVE-2015-5300.patch
 new file mode 100644
index 0000000..563a7ee
--- /dev/null
+++ b/debian/patches/CVE-2015-5300.patch
@@ -0,0 +1,16 @@
+Description: fix timeshifting by reboot issue
+Origin: vendor, http://pkgs.fedoraproject.org/cgit/ntp.git/plain/ntp-4.2.6p5-cve-2015-5300.patch
+Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5300
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_loopfilter.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_loopfilter.c	2015-10-22 16:10:31.039787300 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_loopfilter.c	2015-10-22 16:10:31.039787300 -0400
+@@ -386,6 +386,7 @@
+ 			report_event(EVNT_CLOCKRESET, NULL, tbuf);
+ 			step_systime(fp_offset);
+ 			reinit_timer();
++			allow_panic = FALSE;
+ 			tc_counter = 0;
+ 			clock_jitter = LOGTOD(sys_precision);
+ 			rval = 2;
diff --git a/debian/patches/CVE-2015-7691.patch b/debian/patches/CVE-2015-7691.patch
 new file mode 100644
index 0000000..7dbe95b
--- /dev/null
+++ b/debian/patches/CVE-2015-7691.patch
@@ -0,0 +1,225 @@
+Description: fix incomplete autokey data packet length checks
+Origin: upstream, https://github.com/ntp-project/ntp/commit/c4cd4aaf418f57f7225708a93bf48afb2bc9c1da
+Origin: upstream, https://github.com/ntp-project/ntp/commit/c454d5defd5679947ed34b988c85bab6ed9066cf
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2899
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_crypto.c	2015-10-23 09:06:08.625810791 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c	2015-10-23 09:07:35.018715125 -0400
+@@ -170,6 +170,7 @@
+ static	struct pkey_info *crypto_key (char *, char *, sockaddr_u *);
+ static	void	bighash		(BIGNUM *, BIGNUM *);
+ static	struct cert_info *crypto_cert (char *);
++static	u_int	exten_payload_size(const struct exten *);
+ 
+ #ifdef SYS_WINNT
+ int
+@@ -389,7 +390,7 @@
+ 	struct autokey *ap, *bp; /* autokey pointer */
+ 	struct exten *ep, *fp;	/* extension pointers */
+ 	struct cert_info *xinfo; /* certificate info pointer */
+-	int	has_mac;	/* length of MAC field */
++	int	macbytes;	/* length of MAC field, signed by intention */
+ 	int	authlen;	/* offset of MAC field */
+ 	associd_t associd;	/* association ID */
+ 	tstamp_t tstamp = 0;	/* timestamp */
+@@ -417,7 +418,11 @@
+ 	 */
+ 	authlen = LEN_PKT_NOMAC;
+ 	hismode = (int)PKT_MODE((&rbufp->recv_pkt)->li_vn_mode);
+-	while ((has_mac = rbufp->recv_length - authlen) > MAX_MAC_LEN) {
++	while ((macbytes = rbufp->recv_length - authlen) > (int)MAX_MAC_LEN) {
++		/* We can be reasonably sure that we can read at least
++		 * the opcode and the size field here. More stringent
++		 * checks follow up shortly.
++		 */
+ 		pkt = (u_int32 *)&rbufp->recv_pkt + authlen / 4;
+ 		ep = (struct exten *)pkt;
+ 		code = ntohl(ep->opcode) & 0xffff0000;
+@@ -441,6 +446,18 @@
+ 			code |= CRYPTO_ERROR;
+ 		}
+ 
++		/* Check if the declared size fits into the remaining
++		 * buffer.
++		 */
++		if (len > macbytes) {
++			DPRINTF(1, ("crypto_recv: possible attack detected, associd %d\n",
++				    associd));
++			return XEVNT_LEN;
++		}
++
++		/* Check if the paylod of the extension fits into the
++		 * declared frame.
++		 */
+ 		if (len >= VALUE_LEN) {
+ 			tstamp = ntohl(ep->tstamp);
+ 			fstamp = ntohl(ep->fstamp);
+@@ -1170,9 +1187,8 @@
+ 	 * choice. 
+ 	 */
+ 	case CRYPTO_CERT | CRYPTO_RESP:
+-		vallen = ntohl(ep->vallen);	/* Must be <64k */
+-		if (vallen == 0 || vallen > MAXHOSTNAME ||
+-		    len - VALUE_LEN < vallen) {
++		vallen = exten_payload_size(ep); /* Must be <64k */
++		if (vallen == 0 || vallen >= sizeof(certname) ) {
+ 			rval = XEVNT_LEN;
+ 			break;
+ 
+@@ -2134,8 +2150,7 @@
+ 	tstamp_t tstamp;	/* NTP timestamp */
+ 	BIGNUM	*bn, *bk, *r;
+ 	u_char	*ptr;
+-	u_int	len;		/* extension field length */
+-	u_int	vallen = 0;	/* value length */
++	u_int	len;		/* extension field value length */
+ 
+ 	/*
+ 	 * If the IFF parameters are not valid, something awful
+@@ -2150,11 +2165,10 @@
+ 	/*
+ 	 * Extract r from the challenge.
+ 	 */
+-	vallen = ntohl(ep->vallen);
+-	len = ntohl(ep->opcode) & 0x0000ffff;
+-	if (vallen == 0 || len < VALUE_LEN || len - VALUE_LEN < vallen)
+-		return XEVNT_LEN;
+-	if ((r = BN_bin2bn((u_char *)ep->pkt, vallen, NULL)) == NULL) {
++	len = exten_payload_size(ep);
++	if (len == 0 || len > MAX_VALLEN)
++		return (XEVNT_LEN);
++	if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
+ 		msyslog(LOG_ERR, "crypto_bob: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+ 		return (XEVNT_ERR);
+@@ -2166,7 +2180,7 @@
+ 	 */
+ 	bctx = BN_CTX_new(); bk = BN_new(); bn = BN_new();
+ 	sdsa = DSA_SIG_new();
+-	BN_rand(bk, vallen * 8, -1, 1);		/* k */
++	BN_rand(bk, len * 8, -1, 1);		/* k */
+ 	BN_mod_mul(bn, dsa->priv_key, r, dsa->q, bctx); /* b r mod q */
+ 	BN_add(bn, bn, bk);
+ 	BN_mod(bn, bn, dsa->q, bctx);		/* k + b r mod q */
+@@ -2185,16 +2199,16 @@
+ 	 * Encode the values in ASN.1 and sign. The filestamp is from
+ 	 * the local file.
+ 	 */
+-	vallen = i2d_DSA_SIG(sdsa, NULL);
+-	if (vallen == 0) {
++	len = i2d_DSA_SIG(sdsa, NULL);
++	if (len == 0) {
+ 		msyslog(LOG_ERR, "crypto_bob: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+ 		DSA_SIG_free(sdsa);
+ 		return (XEVNT_ERR);
+ 	}
+-	if (vallen > MAX_VALLEN) {
+-		msyslog(LOG_ERR, "crypto_bob: signature is too big: %d",
+-		    vallen);
++	if (len > MAX_VALLEN) {
++		msyslog(LOG_ERR, "crypto_bob: signature is too big: %u",
++		    len);
+ 		DSA_SIG_free(sdsa);
+ 		return (XEVNT_LEN);
+ 	}
+@@ -2202,8 +2216,8 @@
+ 	tstamp = crypto_time();
+ 	vp->tstamp = htonl(tstamp);
+ 	vp->fstamp = htonl(iffkey_info->fstamp);
+-	vp->vallen = htonl(vallen);
+-	ptr = emalloc(vallen);
++	vp->vallen = htonl(len);
++	ptr = emalloc(len);
+ 	vp->ptr = ptr;
+ 	i2d_DSA_SIG(sdsa, &ptr);
+ 	DSA_SIG_free(sdsa);
+@@ -2214,9 +2228,11 @@
+ 	vp->sig = emalloc(sign_siglen);
+ 	EVP_SignInit(&ctx, sign_digest);
+ 	EVP_SignUpdate(&ctx, (u_char *)&vp->tstamp, 12);
+-	EVP_SignUpdate(&ctx, vp->ptr, vallen);
+-	if (EVP_SignFinal(&ctx, vp->sig, &vallen, sign_pkey))
+-		vp->siglen = htonl(sign_siglen);
++	EVP_SignUpdate(&ctx, vp->ptr, len);
++	if (EVP_SignFinal(&ctx, vp->sig, &len, sign_pkey)) {
++		INSIST(len <= sign_siglen);
++		vp->siglen = htonl(len);
++	}
+ 	return (XEVNT_OK);
+ }
+ 
+@@ -2462,7 +2478,9 @@
+ 	/*
+ 	 * Extract r from the challenge.
+ 	 */
+-	len = ntohl(ep->vallen);
++	len = exten_payload_size(ep);
++	if (len == 0 || len > MAX_VALLEN)
++		return (XEVNT_LEN);
+ 	if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
+ 		msyslog(LOG_ERR, "crypto_bob2: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+@@ -2787,7 +2805,9 @@
+ 	/*
+ 	 * Extract r from the challenge.
+ 	 */
+-	len = ntohl(ep->vallen);
++	len = exten_payload_size(ep);
++	if (len == 0 || len > MAX_VALLEN)
++		return (XEVNT_LEN);
+ 	if ((r = BN_bin2bn((u_char *)ep->pkt, len, NULL)) == NULL) {
+ 		msyslog(LOG_ERR, "crypto_bob3: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+@@ -3002,8 +3022,11 @@
+ 	if (tstamp == 0)
+ 		return (XEVNT_TSP);
+ 
++	len = exten_payload_size(ep);
++	if (len == 0 || len > MAX_VALLEN)
++		return (XEVNT_LEN);
+ 	ptr = (u_char *)ep->pkt;
+-	if ((req = d2i_X509(NULL, &ptr, ntohl(ep->vallen))) == NULL) {
++	if ((req = d2i_X509(NULL, &ptr, len)) == NULL) {
+ 		msyslog(LOG_ERR, "cert_sign: %s",
+ 		    ERR_error_string(ERR_get_error(), NULL));
+ 		return (XEVNT_CRT);
+@@ -3968,6 +3991,36 @@
+ 		break;
+ 	}
+ }
++
++/*
++ * Get the  payload size (internal value length) of an extension packet.
++ * If the inner value size does not match the outer packet size (that
++ * is, the value would end behind the frame given by the opcode/size
++ * field) the function will effectively return UINT_MAX. If the frame is
++ * too short to hold a variable-sized value, the return value is zero.
++ */
++static u_int
++exten_payload_size(
++	const struct exten * ep)
++{
++	typedef const u_char *BPTR;
++	
++	size_t extn_size;
++	size_t data_size;
++	size_t head_size;
++
++	data_size = 0;
++	if (NULL != ep) {
++		head_size = (BPTR)(&ep->vallen + 1) - (BPTR)ep;
++		extn_size = (uint16_t)(ntohl(ep->opcode) & 0x0000ffff);
++		if (extn_size >= head_size) {
++			data_size = (uint32_t)ntohl(ep->vallen);
++			if (data_size > extn_size - head_size)
++				data_size = ~(size_t)0u;
++		}
++	}
++	return (u_int)data_size;
++}
+ # else
+ int ntp_crypto_bs_pubkey;
+ # endif /* OPENSSL */
diff --git a/debian/patches/CVE-2015-7701.patch b/debian/patches/CVE-2015-7701.patch
 new file mode 100644
index 0000000..d04cb2c
--- /dev/null
+++ b/debian/patches/CVE-2015-7701.patch
@@ -0,0 +1,23 @@
+From d7cd5e186034340402f1393e0813c7d2b14ea6ca Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Mon, 28 Sep 2015 18:22:06 +0200
+Subject: [PATCH] [Bug 2909] - Slow memory leak in CRYPTO_ASSOC  - added
+ missing call to 'free()' in ntp_crypto.c.
+
+---
+ ChangeLog         | 1 +
+ ntpd/ntp_crypto.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_crypto.c	2015-10-22 15:25:26.448658993 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_crypto.c	2015-10-22 15:25:26.448658993 -0400
+@@ -500,6 +500,7 @@
+ 					rval = XEVNT_ERR;
+ 					break;
+ 				}
++				free(peer->cmmd); /* will be set again! */
+ 			}
+ 			fp = emalloc(len);
+ 			memcpy(fp, ep, len);
diff --git a/debian/patches/CVE-2015-7704.patch b/debian/patches/CVE-2015-7704.patch
 new file mode 100644
index 0000000..351c7da
--- /dev/null
+++ b/debian/patches/CVE-2015-7704.patch
@@ -0,0 +1,19 @@
+Description: fix denial of service by spoofed KoD
+Author: Miroslav Lichvar <[e-mail]>
+Origin: other, http://lists.ntp.org/pipermail/pool/2015-October/007631.html
+Bug: http://bugs.ntp.org/show_bug.cgi?id=2901
+Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7704
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_proto.c	2015-10-22 15:55:30.498577692 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c	2015-10-22 15:57:47.587982624 -0400
+@@ -1166,7 +1166,7 @@
+ 	peer->ppoll = max(peer->minpoll, pkt->ppoll);
+ 	if (hismode == MODE_SERVER && hisleap == LEAP_NOTINSYNC &&
+ 	    hisstratum == STRATUM_UNSPEC && memcmp(&pkt->refid,
+-	    "RATE", 4) == 0) {
++	    "RATE", 4) == 0 && !(peer->flash & PKT_TEST_MASK)) {
+ 		peer->selbroken++;
+ 		report_event(PEVNT_RATE, peer, NULL);
+ 		if (pkt->ppoll > peer->minpoll)
diff --git a/debian/patches/CVE-2015-7850.patch b/debian/patches/CVE-2015-7850.patch
 new file mode 100644
index 0000000..e7d9491
--- /dev/null
+++ b/debian/patches/CVE-2015-7850.patch
@@ -0,0 +1,235 @@
+backport of:
+
+From bb928ef08eec020ef6008f3a140702ccc0536b8e Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Sat, 3 Oct 2015 09:08:20 +0200
+Subject: [PATCH] [TALOS-CAN-0055] Infinite loop if extended logging enabled
+ and the logfile and keyfile are the same
+
+---
+ ChangeLog             |  2 ++
+ include/ntp_stdlib.h  |  1 +
+ include/ntp_syslog.h  |  1 +
+ libntp/authreadkeys.c | 89 ++++++++++++++++++++++++++++++++++++++++-----------
+ libntp/msyslog.c      | 12 +++++++
+ 5 files changed, 87 insertions(+), 18 deletions(-)
+
+Index: ntp-4.2.6.p5+dfsg/include/ntp_stdlib.h
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/include/ntp_stdlib.h	2015-10-23 08:30:31.515986332 -0400
++++ ntp-4.2.6.p5+dfsg/include/ntp_stdlib.h	2015-10-23 08:30:31.511986291 -0400
+@@ -46,7 +46,8 @@
+ 			__attribute__((__format__(__printf__, 3, 4)));
+ extern	void	msyslog(int, const char *, ...)
+ 				__attribute__((__format__(__printf__, 2, 3)));
+-
++extern	void	mvsyslog(int, const char *, va_list)
++				__attribute__((__format__(__printf__, 2, 0)));
+ /*
+  * When building without OpenSSL, use a few macros of theirs to
+  * minimize source differences in NTP.
+Index: ntp-4.2.6.p5+dfsg/include/ntp_syslog.h
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/include/ntp_syslog.h	2015-10-23 08:30:31.515986332 -0400
++++ ntp-4.2.6.p5+dfsg/include/ntp_syslog.h	2015-10-23 08:30:31.511986291 -0400
+@@ -9,6 +9,7 @@
+ 
+ # ifdef VMS
+ extern void msyslog();
++extern void mvsyslog();
+ # else
+ #   ifndef SYS_VXWORKS
+ #   include <syslog.h>
+Index: ntp-4.2.6.p5+dfsg/libntp/authreadkeys.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/libntp/authreadkeys.c	2015-10-23 08:30:31.515986332 -0400
++++ ntp-4.2.6.p5+dfsg/libntp/authreadkeys.c	2015-10-23 08:32:05.104935695 -0400
+@@ -61,6 +61,40 @@
+ }
+ 
+ 
++/* TALOS-CAN-0055: possibly DoS attack by setting the key file to the
++ * log file. This is hard to prevent (it would need to check two files
++ * to be the same on the inode level, which will not work so easily with
++ * Windows or VMS) but we can avoid the self-amplification loop: We only
++ * log the first 5 errors, silently ignore the next 10 errors, and give
++ * up when when we have found more than 15 errors.
++ *
++ * This avoids the endless file iteration we will end up with otherwise,
++ * and also avoids overflowing the log file.
++ *
++ * Nevertheless, once this happens, the keys are gone since this would
++ * require a save/swap strategy that is not easy to apply due to the
++ * data on global/static level.
++ */
++
++static const size_t nerr_loglimit = 5u;
++static const size_t nerr_maxlimit = 15;
++
++static void log_maybe(size_t*, const char*, ...) __attribute__((__format__(__printf__, 2, 3)));
++
++static void
++log_maybe(
++	size_t     *pnerr,
++	const char *fmt  ,
++	...)
++{
++	va_list ap;
++	if (++(*pnerr) <= nerr_loglimit) {
++		va_start(ap, fmt);
++		mvsyslog(LOG_ERR, fmt, ap);
++		va_end(ap);
++	}
++}
++
+ /*
+  * authreadkeys - (re)read keys from a file.
+  */
+@@ -78,7 +112,7 @@
+ 	u_char	keystr[20];
+ 	int	len;
+ 	int	j;
+-
++	size_t  nerr;
+ 	/*
+ 	 * Open file.  Complain and return if it can't be opened.
+ 	 */
+@@ -98,7 +132,10 @@
+ 	/*
+ 	 * Now read lines from the file, looking for key entries
+ 	 */
++	nerr = 0;
+ 	while ((line = fgets(buf, sizeof buf, fp)) != NULL) {
++		if (nerr > nerr_maxlimit)
++			break;
+ 		token = nexttok(&line);
+ 		if (token == NULL)
+ 			continue;
+@@ -108,15 +145,16 @@
+ 		 */
+ 		keyno = atoi(token);
+ 		if (keyno == 0) {
+-			msyslog(LOG_ERR,
+-			    "authreadkeys: cannot change key %s", token);
++			log_maybe(&nerr,
++				  "authreadkeys: cannot change key %s",
++				  token);
+ 			continue;
+ 		}
+ 
+ 		if (keyno > NTP_MAXKEY) {
+-			msyslog(LOG_ERR,
+-			    "authreadkeys: key %s > %d reserved for Autokey",
+-			    token, NTP_MAXKEY);
++			log_maybe(&nerr,
++				  "authreadkeys: key %s > %d reserved for Autokey",
++				  token, NTP_MAXKEY);
+ 			continue;
+ 		}
+ 
+@@ -125,8 +163,9 @@
+ 		 */
+ 		token = nexttok(&line);
+ 		if (token == NULL) {
+-			msyslog(LOG_ERR,
+-			    "authreadkeys: no key type for key %d", keyno);
++			log_maybe(&nerr,
++				  "authreadkeys: no key type for key %d",
++				  keyno);
+ 			continue;
+ 		}
+ #ifdef OPENSSL
+@@ -138,13 +177,15 @@
+ 		 */
+ 		keytype = keytype_from_text(token, NULL);
+ 		if (keytype == 0) {
+-			msyslog(LOG_ERR,
+-			    "authreadkeys: invalid type for key %d", keyno);
++			log_maybe(&nerr,
++				  "authreadkeys: invalid type for key %d",
++				  keyno);
+ 			continue;
+ 		}
+ 		if (EVP_get_digestbynid(keytype) == NULL) {
+-			msyslog(LOG_ERR,
+-			    "authreadkeys: no algorithm for key %d", keyno);
++			log_maybe(&nerr,
++				  "authreadkeys: no algorithm for key %d",
++				  keyno);
+ 			continue;
+ 		}
+ #else /* OPENSSL */
+@@ -154,8 +195,9 @@
+ 		 * 'm' for compatibility.
+ 		 */
+ 		if (!(*token == 'M' || *token == 'm')) {
+-			msyslog(LOG_ERR,
+-			    "authreadkeys: invalid type for key %d", keyno);
++			log_maybe(&nerr,
++				  "authreadkeys: invalid type for key %d",
++				  keyno);
+ 			continue;
+ 		}
+ 		keytype = KEY_TYPE_MD5;
+@@ -169,8 +211,8 @@
+ 		 */
+ 		token = nexttok(&line);
+ 		if (token == NULL) {
+-			msyslog(LOG_ERR,
+-			    "authreadkeys: no key for key %d", keyno);
++			log_maybe(&nerr,
++				  "authreadkeys: no key for key %d", keyno);
+ 			continue;
+ 		}
+ 		len = strlen(token);
+@@ -186,8 +228,9 @@
+ 			for (j = 0; j < jlim; j++) {
+ 				ptr = strchr(hex, tolower(token[j]));
+ 				if (ptr == NULL) {
+-					msyslog(LOG_ERR,
+-					    "authreadkeys: invalid hex digit for key %d", keyno);
++				log_maybe(&nerr,
++					  "authreadkeys: invalid hex digit for key %d",
++					  keyno);
+ 					continue;
+ 				}
+ 				temp = (u_char)(ptr - hex);
+@@ -200,5 +243,15 @@
+ 		}
+ 	}
+ 	fclose(fp);
++	if (nerr > nerr_maxlimit) {
++		msyslog(LOG_ERR,
++			"authreadkeys: emergency break after %u errors",
++			nerr);
++		return (0);
++	} else if (nerr > nerr_loglimit) {
++		msyslog(LOG_ERR,
++			"authreadkeys: found %u more error(s)",
++			nerr - nerr_loglimit);
++	}
+ 	return (1);
+ }
+Index: ntp-4.2.6.p5+dfsg/libntp/msyslog.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/libntp/msyslog.c	2015-10-23 08:30:31.515986332 -0400
++++ ntp-4.2.6.p5+dfsg/libntp/msyslog.c	2015-10-23 08:30:31.511986291 -0400
+@@ -271,6 +271,18 @@
+ 	return rc;
+ }
+ 
++void
++mvsyslog(
++	int		level,
++	const char *	fmt,
++	va_list		ap
++	)
++{
++	char	buf[1024];
++	mvsnprintf(buf, sizeof(buf), fmt, ap);
++	addto_syslog(level, buf);
++}
++
+ 
+ void
+ msyslog(
diff --git a/debian/patches/CVE-2015-7852.patch b/debian/patches/CVE-2015-7852.patch
 new file mode 100644
index 0000000..33cc916
--- /dev/null
+++ b/debian/patches/CVE-2015-7852.patch
@@ -0,0 +1,35 @@
+Backport of:
+
+From 07a5b8141e354a998a52994c3c9cd547927e56ce Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Wed, 30 Sep 2015 20:15:13 +0200
+Subject: [PATCH] [TALOS-CAN-0063] avoid buffer overrun in ntpq
+
+---
+ ChangeLog   | 1 +
+ ntpq/ntpq.c | 7 ++++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+Index: ntp-4.2.6.p5+dfsg/ntpq/ntpq.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpq/ntpq.c	2015-10-22 16:25:23.504874749 -0400
++++ ntp-4.2.6.p5+dfsg/ntpq/ntpq.c	2015-10-22 16:27:01.905821489 -0400
+@@ -3448,12 +3448,17 @@
+ 			char bv[401];
+ 			int len;
+ 
++			/* TALOS-CAN-0063: avoid buffer overrun */
+ 			atoascii(name, MAXVARLEN, bn, sizeof(bn));
+-			atoascii(value, MAXVARLEN, bv, sizeof(bv));
+ 			if (output_raw != '*') {
++				atoascii(value, MAXVALLEN,
++					 bv, sizeof(bv) - 1);
+ 				len = strlen(bv);
+ 				bv[len] = output_raw;
+ 				bv[len+1] = '\0';
++			} else {
++				atoascii(value, MAXVALLEN,
++					 bv, sizeof(bv));
+ 			}
+ 			output(fp, bn, bv);
+ 		}
diff --git a/debian/patches/CVE-2015-7853.patch b/debian/patches/CVE-2015-7853.patch
 new file mode 100644
index 0000000..f6a1202
--- /dev/null
+++ b/debian/patches/CVE-2015-7853.patch
@@ -0,0 +1,46 @@
+Backport of:
+
+From 8482b536f9494a5d45196ab5b7e13040f5940261 Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Wed, 30 Sep 2015 21:55:09 +0200
+Subject: [PATCH] [TALOS-CAN-0064] signed/unsiged clash could lead to buffer
+ overun
+
+---
+ ChangeLog     |  2 ++
+ ntpd/ntp_io.c | 15 +++++++++------
+ 2 files changed, 11 insertions(+), 6 deletions(-)
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_io.c	2015-10-22 16:27:40.686182025 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c	2015-10-22 16:32:28.776865553 -0400
+@@ -3255,7 +3255,7 @@
+ static inline int
+ read_refclock_packet(SOCKET fd, struct refclockio *rp, l_fp ts)
+ {
+-	int i;
++	u_int read_count;
+ 	int buflen;
+ 	register struct recvbuf *rb;
+ 
+@@ -3272,11 +3272,14 @@
+ 		return (buflen);
+ 	}
+ 
+-	i = (rp->datalen == 0
+-	     || rp->datalen > sizeof(rb->recv_space))
+-		? sizeof(rb->recv_space)
+-		: rp->datalen;
+-	buflen = read(fd, (char *)&rb->recv_space, (unsigned)i);
++	/* TALOS-CAN-0064: avoid signed/unsigned clashes that can lead
++	 * to buffer overrun and memory corruption
++	 */
++	if (rp->datalen <= 0 || rp->datalen > sizeof(rb->recv_space))
++		read_count = sizeof(rb->recv_space);
++	else
++		read_count = (u_int)rp->datalen;
++	buflen = read(fd, (char *)&rb->recv_space, read_count);
+ 
+ 	if (buflen < 0) {
+ 		if (errno != EINTR && errno != EAGAIN)
diff --git a/debian/patches/CVE-2015-7855.patch b/debian/patches/CVE-2015-7855.patch
 new file mode 100644
index 0000000..91a44e3
--- /dev/null
+++ b/debian/patches/CVE-2015-7855.patch
@@ -0,0 +1,29 @@
+Backport of:
+
+From ba716a464ecb20618560075f2e4e1051e5b6f24f Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Tue, 6 Oct 2015 08:51:27 +0000
+Subject: [PATCH] [Sec 2922] decodenetnum() will ASSERT botch instead of
+ returning FAIL on some bogus values.  Harlan Stenn.
+
+---
+ ChangeLog             | 2 ++
+ libntp/decodenetnum.c | 5 ++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+Index: ntp-4.2.6.p5+dfsg/libntp/decodenetnum.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/libntp/decodenetnum.c	2015-10-22 16:33:46.801593867 -0400
++++ ntp-4.2.6.p5+dfsg/libntp/decodenetnum.c	2015-10-22 16:34:20.921912557 -0400
+@@ -36,7 +36,10 @@
+ 	char name[80];
+ 
+ 	NTP_REQUIRE(num != NULL);
+-	NTP_REQUIRE(strlen(num) < sizeof(name));
++
++	if (strlen(num) >= sizeof(name)) {
++		return 0;
++	}
+ 
+ 	port_str = NULL;
+ 	if ('[' != num[0]) {
diff --git a/debian/patches/CVE-2015-7871.patch b/debian/patches/CVE-2015-7871.patch
 new file mode 100644
index 0000000..249882b
--- /dev/null
+++ b/debian/patches/CVE-2015-7871.patch
@@ -0,0 +1,40 @@
+From aa44b5835d69d8ee031736bb8ee2730a514edb7d Mon Sep 17 00:00:00 2001
+From:  <[e-mail]>
+Date: Sun, 11 Oct 2015 08:10:20 +0200
+Subject: [PATCH] [Bug 2941] NAK to the Future: Symmetric association
+ authentication bypass via crypto-NAK
+
+---
+ ChangeLog        |  3 +++
+ ntpd/ntp_proto.c | 18 ++++++++++++++++++
+ 2 files changed, 21 insertions(+)
+
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_proto.c	2015-10-22 16:35:02.202298283 -0400
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_proto.c	2015-10-22 16:37:51.971886405 -0400
+@@ -957,6 +957,24 @@
+ 				sys_restricted++;
+ 				return;
+ 			}
++			/* [Bug 2941]
++			 * If we got here, the packet isn't part of an
++			 * existing association, it isn't correctly
++			 * authenticated, and it didn't meet either of
++			 * the previous two special cases so we should
++			 * just drop it on the floor.  For example,
++			 * crypto-NAKs (is_authentic == AUTH_CRYPTO)
++			 * will make it this far.  This is just
++			 * debug-printed and not logged to avoid log
++			 * flooding.
++			 */
++			DPRINTF(1, ("receive: at %ld refusing to mobilize passive association"
++				    " with unknown peer %s mode %d keyid %08x len %d auth %d\n",
++				    current_time, stoa(&rbufp->recv_srcadr),
++				    hismode, skeyid, (authlen + has_mac),
++				    is_authentic));
++			sys_declined++;
++			return;
+ 		}
+ 
+ 		/*
diff --git a/debian/patches/ignore-ENOBUFS-on-routing-netlink-socket.patch b/debian/patches/ignore-ENOBUFS-on-routing-netlink-socket.patch
 new file mode 100644
index 0000000..3d1ec56
--- /dev/null
+++ b/debian/patches/ignore-ENOBUFS-on-routing-netlink-socket.patch
@@ -0,0 +1,32 @@
+Description: [Bug 2890] Ignore ENOBUFS on routing netlink socket.
+
+Recv from netlink socket can return ENOBUFS if kernel failed to allocate buffer
+for broadcast message. This happens from time-time on high-loaded systems with
+a lot of interface and huge routing tables.
+
+Bug   : http://bugs.ntp.org/show_bug.cgi?id=2890
+Author:      <[e-mail]>
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_io.c
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c
+@@ -4433,10 +4433,15 @@ process_routing_msgs(struct asyncio_read
+ 	cnt = read(reader->fd, buffer, sizeof(buffer));
+ 	
+ 	if (cnt < 0) {
+-		msyslog(LOG_ERR,
+-			"i/o error on routing socket %m - disabling");
+-		remove_asyncio_reader(reader);
+-		delete_asyncio_reader(reader);
++                if (errno == ENOBUFS) {
++                        msyslog(LOG_ERR,
++                                "routing socket reports: %m");
++                } else {
++                        msyslog(LOG_ERR,
++                                "routing socket reports: %m - disabling");
++                        remove_asyncio_reader(reader);
++                        delete_asyncio_reader(reader);
++                }
+ 		return;
+ 	}
+ 
diff --git a/debian/patches/ntp-keygen-endless-loop.patch b/debian/patches/ntp-keygen-endless-loop.patch
 new file mode 100644
index 0000000..f0e387c
--- /dev/null
+++ b/debian/patches/ntp-keygen-endless-loop.patch
@@ -0,0 +1,38 @@
+Description: fix ntp-keygen infinite loop or lack of randonmess on big
+ endian platforms
+Origin: backport, http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg
+Bug: https://bugs.ntp.org/show_bug.cgi?id=2797
+
+Index: ntp-4.2.6.p5+dfsg/util/ntp-keygen.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/util/ntp-keygen.c	2015-04-13 08:58:49.317778349 -0400
++++ ntp-4.2.6.p5+dfsg/util/ntp-keygen.c	2015-04-13 08:58:49.317778349 -0400
+@@ -726,24 +726,24 @@
+ 	ntp_srandom((u_long)epoch);
+ 	for (i = 1; i <= MD5KEYS; i++) {
+ 		for (j = 0; j < MD5SIZE; j++) {
+-			int temp;
++			u_char temp;
+ 
+ 			while (1) {
+ 				int rc;
+ 
+-				rc = ntp_crypto_random_buf(&temp, 1);
++				rc = ntp_crypto_random_buf(
++				    &temp, sizeof(temp));
+ 				if (-1 == rc) {
+ 					fprintf(stderr, "ntp_crypto_random_buf() failed.\n");
+ 					exit (-1);
+ 				}
+-				temp &= 0xff;
+ 				if (temp == '#')
+ 					continue;
+ 
+ 				if (temp > 0x20 && temp < 0x7f)
+ 					break;
+ 			}
+-			md5key[j] = (u_char)temp;
++			md5key[j] = temp;
+ 		}
+ 		md5key[j] = '\0';
+ 		fprintf(str, "%2d MD5 %s  # MD5 key\n", i,
diff --git a/debian/patches/series b/debian/patches/series
index c2ec25e..a1ccd71 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -10,3 +10,28 @@ format-security.patch
 sntp-manpage.patch
 openssl-headers.patch
 autotools.patch
+CVE-2014-9293.patch
+CVE-2014-9294.patch
+CVE-2014-9295.patch
+CVE-2014-9296.patch
+CVE-2014-9297.patch
+CVE-2014-9298.patch
+CVE-2015-1798.patch
+CVE-2015-1799.patch
+ntp-keygen-endless-loop.patch
+use-after-free-in-routing-socket.patch
+ignore-ENOBUFS-on-routing-netlink-socket.patch
+CVE-2015-5146.patch
+CVE-2015-5194.patch
+CVE-2015-5195.patch
+CVE-2015-5219.patch
+CVE-2015-5300.patch
+CVE-2015-7691.patch
+CVE-2015-7701.patch
+CVE-2015-5196.patch
+CVE-2015-7704.patch
+CVE-2015-7850.patch
+CVE-2015-7852.patch
+CVE-2015-7853.patch
+CVE-2015-7855.patch
+CVE-2015-7871.patch
diff --git a/debian/patches/use-after-free-in-routing-socket.patch b/debian/patches/use-after-free-in-routing-socket.patch
 new file mode 100644
index 0000000..e7c8dec
--- /dev/null
+++ b/debian/patches/use-after-free-in-routing-socket.patch
@@ -0,0 +1,33 @@
+Description:  Fix use-after-free in routing socket code.
+Origin:       backport, https://bugs.ntp.org/attachment.cgi?id=883 
+Bug:          http://bugs.ntp.org/2224
+Index: ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c
+===================================================================
+--- ntp-4.2.6.p5+dfsg.orig/ntpd/ntp_io.c
++++ ntp-4.2.6.p5+dfsg/ntpd/ntp_io.c
+@@ -3534,7 +3534,8 @@ input_handler(
+ 	int select_count = 0;
+ 	endpt *ep;
+ #if defined(HAS_ROUTING_SOCKET)
+-	struct asyncio_reader *asyncio_reader;
++	struct asyncio_reader * asyncio_reader;
++	struct asyncio_reader * next_asyncio_reader;
+ #endif
+ 
+ 	handler_calls++;
+@@ -3637,11 +3638,13 @@ input_handler(
+ 	asyncio_reader = asyncio_reader_list;
+ 
+ 	while (asyncio_reader != NULL) {
++		/* callback may unlink and free asyncio_reader */
++		next_asyncio_reader = asyncio_reader->link;
+ 		if (FD_ISSET(asyncio_reader->fd, &fds)) {
+ 			++select_count;
+-			(asyncio_reader->receiver)(asyncio_reader);
++			(*asyncio_reader->receiver)(asyncio_reader);
+ 		}
+-		asyncio_reader = asyncio_reader->link;
++		asyncio_reader = next_asyncio_reader;
+ 	}
+ #endif /* HAS_ROUTING_SOCKET */
+ 	
diff --git a/debian/rules b/debian/rules
index 6effbda..0a1733d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,11 +1,15 @@
 #!/usr/bin/make -f
 
+export DEB_BUILD_HARDENING=1
+
 # hacks to avoid running these things during the build
 export ACLOCAL    = : aclocal
 export AUTOCONF   = : autoconf
 export AUTOMAKE   = : automake
 export AUTOHEADER = : autoheader
 
+genfiles:=ntpd/ntp_parser.c ntpd/ntp_parser.h
+
 DEB_HOST_ARCH_OS ?= $(shell dpkg-architecture -qDEB_HOST_ARCH_OS)
 
 CPPFLAGS = $(shell dpkg-buildflags --get CPPFLAGS) -D_GNU_SOURCE
@@ -19,10 +23,14 @@ ifeq (hurd, $(DEB_HOST_ARCH_OS))
 	exit 1
 endif
 	cp /usr/share/misc/config.guess /usr/share/misc/config.sub .
+	cp /usr/share/misc/config.guess /usr/share/misc/config.sub sntp/.
+	# backup autogenerated files
+	for f in $(genfiles); do mv -f $$f $$f.backup; done
+
 	./configure CFLAGS='$(CFLAGS)' CPPFLAGS='$(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' \
 		--prefix=/usr \
 		--enable-all-clocks --enable-parse-clocks --enable-SHM \
-		--disable-debugging --sysconfdir=/var/lib/ntp \
+		--enable-debugging --sysconfdir=/var/lib/ntp \
 		--with-sntp=no \
 		--with-lineeditlibs=edit \
 		--without-ntpsnmpd \
@@ -45,6 +53,10 @@ clean:
 	rm -f build-stamp 
 	[ ! -f Makefile ] || $(MAKE) -k distclean
 	rm -f config.guess config.sub
+	# restore autogenerated files
+	for f in $(genfiles); do \
+		[ ! -e $$f.backup ] || ( rm -rf $$f; mv $$f.backup $$f ) ; \
+	done
 	dh_clean
 
 install: build-stamp
@@ -73,6 +85,14 @@ install: build-stamp
 	# remove upstream man pages, which are currently not as nice as ours / ntpsnmpd we don't want
 	rm $(addprefix debian/ntp/usr/share/man/man1/,ntpd.1 ntpdc.1 ntp-keygen.1 ntpq.1 ntpsnmpd.1)
 
+	# install apparmor profile
+	install -D -m 0644 debian/apparmor-profile debian/ntp/etc/apparmor.d/usr.sbin.ntpd
+	install -D -m 0644 debian/apparmor-profile.tunable debian/ntp/etc/apparmor.d/tunables/ntpd
+	dh_link -pntp etc/apparmor.d/usr.sbin.ntpd etc/apparmor/init/network-interface-security/usr.sbin.ntpd
+
+	# install apport hook
+	install -D -m 644 debian/source_ntp.py debian/ntp/usr/share/apport/package-hooks/source_ntp.py
+
 	dh_movefiles --sourcedir=debian/ntp
 
 binary-indep: build install
@@ -100,7 +120,8 @@ binary-arch: build install
 	dh_installdocs -a
 	dh_installexamples -a
 	dh_installman -a
-	dh_installinit -pntp --update-rcd-params="start 23 2 3 4 5 ." --error-handler=installinit_error
+	dh_apparmor -pntp --profile-name=usr.sbin.ntpd
+	dh_installinit -pntp --update-rcd-params="start 23 2 3 4 5 . stop 77 1 ." --error-handler=installinit_error
 	dh_installinit -pntpdate
 	dh_installcron -a
 	dh_installlogcheck -a
diff --git a/debian/source_ntp.py b/debian/source_ntp.py
 new file mode 100644
index 0000000..3debc68
--- /dev/null
+++ b/debian/source_ntp.py
@@ -0,0 +1,22 @@
+'''apport package hook for ntp
+
+(c) 2010-2011 Canonical Ltd.
+Author: Chuck Short <[e-mail]>
+'''
+
+from apport.hookutils import *
+from os import path
+import re
+
+def add_info(report):
+	attach_conffiles(report, 'ntp')
+
+	# get apparmor stuff
+	attach_mac_events(report, '/usr/sbin/ntpd')
+	attach_file(report, '/etc/apparmor.d/usr.sbin.ntpd')
+
+	# get syslog stuff
+	recent_syslog(re.compile(r'ntpd\['))
+
+	# Get debug information
+	report['NtpStatus'] = command_output(['ntpq', '-p'])