CVE-2009-3589
incron 0.5.5 does not initialize supplementary groups when running a process from a user's...
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
Exploit likelihood
What each source reports
NVD Score used
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
CVE-2009-3589- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
CVE-2009-3589- Updated
- 2026-11-02
EUVDEUVD-2009-3570 No score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
EUVD-2009-3570- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vq38-j6m4-jpjp No score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's...
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
GHSA-vq38-j6m4-jpjp- Updated
- 2026-11-02
OSV No score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
CVE-2009-3589- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3589 No score
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
- Record
DEBIAN-CVE-2009-3589- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3589 is a medium vulnerability (CVSS 4.6) in Inotify Incron, published October 8, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in incron 0.5.7-1.