Description
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.
References (5)
Core 5
Core References
Patch, Third Party Advisory x_refsource_misc
https://salsa.debian.org/debian/cron/commit/40791b93
Exploit, Mailing List, Vendor Advisory x_refsource_misc
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167
Mailing List, Patch, Vendor Advisory x_refsource_misc
https://packages.qa.debian.org/c/cron/news/20190311T170403Z.html
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
Scores
CVSS v3
5.5
EPSS
0.0046
EPSS Percentile
36.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-416
Status
published
Products (1)
debian/cron
3.0 (50 CPE variants)
Published
Mar 12, 2019
Tracked Since
Feb 18, 2026