{"id":"CVE-2017-9525","aliases":["DEBIAN-CVE-2017-9525","DLA-1723-1","DLA-2801-1","EUVD-2017-18456","GHSA-p8jr-r46j-qpx9","UBUNTU-CVE-2017-9525","USN-5259-1","USN-5259-2","USN-5259-3"],"status":"published","title":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the...","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00551,"percentile":0.4635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2017-06-09T16:00:00Z","modified":"2026-09-01T20:03:52Z","fixes":[{"ecosystem":"Debian:12","package":"cron","fixed_in":["3.0pl1-129"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cron","fixed_in":["3.0pl1-129"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cron","fixed_in":["3.0pl1-129"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"systemd-cron","fixed_in":["1.5.17-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"systemd-cron","fixed_in":["1.5.17-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"systemd-cron","fixed_in":["1.5.17-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","fixed_in":["3.0pl1-128ubuntu2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cron","fixed_in":["3.0pl1-128.1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-129"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-129"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-129"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"systemd-cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.17-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"systemd-cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.17-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"systemd-cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.17-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-127+deb8u2"}]}],"versions":["3.0pl1-127","3.0pl1-127+deb8u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:9","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128+deb9u2"}]}],"versions":["3.0pl1-128","3.0pl1-128+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0pl1-124ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128ubuntu2+esm2"}]}],"versions":["3.0pl1-127ubuntu1","3.0pl1-128ubuntu1","3.0pl1-128ubuntu2","3.0pl1-128ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128.1ubuntu1.2"}]}],"versions":["3.0pl1-128ubuntu5","3.0pl1-128.1ubuntu1","3.0pl1-128.1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128ubuntu2+esm1"}]}],"versions":["3.0pl1-127ubuntu1","3.0pl1-128ubuntu1","3.0pl1-128ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128.1ubuntu1.1"}]}],"versions":["3.0pl1-128ubuntu5","3.0pl1-128.1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128ubuntu2+esm2"}]}],"versions":["3.0pl1-127ubuntu1","3.0pl1-128ubuntu1","3.0pl1-128ubuntu2","3.0pl1-128ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128.1ubuntu1.2"}]}],"versions":["3.0pl1-128ubuntu5","3.0pl1-128.1ubuntu1","3.0pl1-128.1ubuntu1.1"]}],"products":[{"vendor":"cron_project","product":"cron"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"http://bugs.debian.org/864466","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","Vendor Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/06/08/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1038651","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9525"},{"url":"https://github.com/advisories/GHSA-p8jr-r46j-qpx9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-9525","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-9525","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5259-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5259-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5259-3","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9706","tags":["report"]},{"url":"https://launchpad.net/bugs/1971895","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-9525","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","status":"published","published":"2017-06-09T16:00:00Z","modified":"2024-08-05T17:11:01.621Z","updated_at":"2026-11-02T14:33:13.96587Z"}],"euvd":[{"id":"EUVD-2017-18456","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","status":"published","published":"2017-06-09T16:00:00Z","modified":"2024-08-05T17:11:01Z","updated_at":"2026-11-03T02:23:27.678389Z"}],"ghsa":[{"id":"GHSA-p8jr-r46j-qpx9","title":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the...","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","status":"published","published":"2022-05-13T01:04:25Z","modified":"2023-02-01T05:02:46Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:49:57.916243Z"}],"nvd":[{"id":"CVE-2017-9525","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","status":"published","published":"2017-06-09T16:29:02.11Z","modified":"2026-06-17T01:28:18.113Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:03:50.782497Z"}],"osv":[{"id":"CVE-2017-9525","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","status":"published","published":"2017-06-09T16:29:02.11Z","modified":"2026-03-15T22:18:07.404932Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2017-9525","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","status":"published","published":"2017-06-09T16:29:02.11Z","modified":"2026-09-01T20:03:52.378264041Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-9525","description":"In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.","status":"published","published":"2017-06-09T16:29:00Z","modified":"2026-02-04T04:34:56.177362Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1723-1","title":"cron - security update","status":"published","published":"2019-03-21T00:00:00Z","modified":"2026-03-09T01:19:57.350129Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2801-1","title":"cron - security update","status":"published","published":"2021-10-30T00:00:00Z","modified":"2026-03-09T01:20:13.333286Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"USN-5259-1","title":"cron vulnerabilities","description":"It was discovered that the postinst maintainer script in Cron unsafely\nhandled file permissions during package install or update operations.\nAn attacker could possibly use this issue to perform a privilege\nescalation attack. (CVE-2017-9525)\n\nFlorian Weimer discovered that Cron incorrectly handled certain memory\noperations during crontab file creation. An attacker could possibly use\nthis issue to cause a denial of service. (CVE-2019-9704)\n\nIt was discovered that Cron incorrectly handled user input during crontab\nfile creation. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2019-9705)\n\nIt was discovered that Cron contained a use-after-free vulnerability in\nits force_rescan_user function. An attacker could possibly use this issue\nto cause a denial of service. (CVE-2019-9706)\n","status":"published","published":"2022-02-01T14:38:29Z","modified":"2026-06-25T13:31:00.15743463Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5259-2","title":"cron vulnerabilities","description":"USN-5259-1 fixed several vulnerabilities in Cron. This update provides\nthe corresponding update for Ubuntu 18.04 LTS. \n\nOriginal advisory details:\n\n It was discovered that the postinst maintainer script in Cron unsafely\n handled file permissions during package install or update operations.\n An attacker could possibly use this issue to perform a privilege\n escalation attack. (CVE-2017-9525)\n \n Florian Weimer discovered that Cron incorrectly handled certain memory\n operations during crontab file creation. An attacker could possibly use\n this issue to cause a denial of service. (CVE-2019-9704)\n \n It was discovered that Cron incorrectly handled user input during crontab\n file creation. An attacker could possibly use this issue to cause a denial\n of service. (CVE-2019-9705)\n \n It was discovered that Cron contained a use-after-free vulnerability in\n its force_rescan_user function. An attacker could possibly use this issue\n to cause a denial of service. (CVE-2019-9706)\n","status":"published","published":"2022-05-06T08:42:24Z","modified":"2026-04-27T16:02:37.47757Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5259-3","title":"cron regression","description":"USN-5259-1 and USN-5259-2 fixed vulnerabilities in Cron. Unfortunately\nthat update was incomplete and could introduce a regression. This update\nfixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n It was discovered that the postinst maintainer script in Cron unsafely\n handled file permissions during package install or update operations.\n An attacker could possibly use this issue to perform a privilege\n escalation attack. (CVE-2017-9525)\n \n Florian Weimer discovered that Cron incorrectly handled certain memory\n operations during crontab file creation. An attacker could possibly use\n this issue to cause a denial of service. (CVE-2019-9704)\n \n It was discovered that Cron incorrectly handled user input during crontab\n file creation. An attacker could possibly use this issue to cause a denial\n of service. (CVE-2019-9705)\n \n It was discovered that Cron contained a use-after-free vulnerability in\n its force_rescan_user function. An attacker could possibly use this issue\n to cause a denial of service. (CVE-2019-9706)\n","status":"published","published":"2022-05-11T00:25:41Z","modified":"2026-06-25T13:30:14.520158123Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}