CVE-2009-3589
incron 0.5.5 does not initialize supplementary groups when running a process from a user's...
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
Exploit likelihood
What each source reports
NVD Score used
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
CVE-2009-3589- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
CVE-2009-3589- Updated
- 2026-11-02
EUVDEUVD-2009-3570No score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
EUVD-2009-3570- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vq38-j6m4-jpjpNo score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's...
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
GHSA-vq38-j6m4-jpjp- Updated
- 2026-11-02
OSVNo score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
CVE-2009-3589- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3589No score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
DEBIAN-CVE-2009-3589- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3589 is a medium vulnerability (CVSS 4.6) in Inotify Incron, published October 8, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in incron 0.5.7-1.