CVE-2019-9706

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-03-12 · updated 2026-06-17
Weakness: CWE-416

Description

Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.

Affected products

Debian Cron: 3.0, 3.0-pl1, 3.0-pl1-100, 3.0-pl1-101, 3.0-pl1-102, 3.0-pl1-103 (+91)
Debian Linux: 8.0, 9.0

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167
https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
https://packages.qa.debian.org/c/cron/news/20190311T170403Z.html
https://salsa.debian.org/debian/cron/commit/40791b93
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167
https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
https://packages.qa.debian.org/c/cron/news/20190311T170403Z.html
https://salsa.debian.org/debian/cron/commit/40791b93

Get alerted when CVE-2019-9706 or the next vulnerability affects your stack