What is CVE-2014-9751?

CVE-2014-9751 is a vulnerability in Apple macOS, classified under Improper Input Validation. Published 2015-10-06.

Is CVE-2014-9751 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Apple macOS

CVE-2014-9751

The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2015-10-06 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.045 (91.2th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.045 · newest: 0.045 · change: 0.000

Affected products

Apple macOS
Linux Kernel
NTP — versions 4.2.8
Oracle Linux — versions 7
Debian Linux — versions 7.0, 8.0, 9.0
Red Hat Enterprise Linux Desktop — versions 6.0
Red Hat Enterprise Linux Server — versions 6.0
Red Hat Enterprise Linux Workstation — versions 6.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

c-skills/CVEs

References

www.kb.cert.org/vuls/id/852879 (US Government Resource, Third Party Advisory, third-party-advisory)
support.ntp.org/bin/view/Main/SecurityNotice (Vendor Advisory)
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html (Third Party Advisory)
bugs.ntp.org/show_bug.cgi (Patch, Issue Tracking, Vendor Advisory)
www.debian.org/security/2015/dsa-3388 (vendor-advisory, Third Party Advisory)
www.securityfocus.com/bid/72584 (VDB Entry, Third Party Advisory, vdb-entry)
rhn.redhat.com/errata/RHSA-2015-1459.html (vendor-advisory, Third Party Advisory)
support.hpe.com/hpsc/doc/public/display (Third Party Advisory)
bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2014-9751?: CVE-2014-9751 is a vulnerability in Apple macOS, classified under Improper Input Validation. Published 2015-10-06.
Is CVE-2014-9751 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.