CVE-2019-9706

moderate-risk

Published 2019-03-12

Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Cron

Affected Vendors

Debian

References (10)

Exploit https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167

Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html

Mailing List https://packages.qa.debian.org/c/cron/news/20190311T170403Z.html

Patch https://salsa.debian.org/debian/cron/commit/40791b93

Exploit https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167

Mailing List https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html

Mailing List https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html

Mailing List https://packages.qa.debian.org/c/cron/news/20190311T170403Z.html

Patch https://salsa.debian.org/debian/cron/commit/40791b93

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 30/34 · Critical