{"id":"CVE-2019-9704","aliases":["DEBIAN-CVE-2019-9704","DLA-1723-1","DLA-2801-1","EUVD-2019-19070","GHSA-34r4-h4c9-vmrj","MGASA-2019-0157","SUSE-SU-2019:1389-1","SUSE-SU-2019:1389-2","SUSE-SU-2019:1990-1","UBUNTU-CVE-2019-9704","USN-5259-1","USN-5259-2","openSUSE-SU-2019:1520-1","openSUSE-SU-2024:10701-1"],"status":"published","title":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service ...","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00365,"percentile":0.30519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-252","CWE-476"],"published":"2019-03-12T00:00:00Z","modified":"2026-09-21T07:03:26Z","fixes":[{"ecosystem":"Debian:12","package":"cron","fixed_in":["3.0pl1-133"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cron","fixed_in":["3.0pl1-133"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cron","fixed_in":["3.0pl1-133"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","fixed_in":["3.0pl1-128ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cron","fixed_in":["3.0pl1-128.1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cronie","fixed_in":["1.5.7-86.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-133"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-133"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-133"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-127+deb8u2"}]}],"versions":["3.0pl1-127","3.0pl1-127+deb8u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:9","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128+deb9u2"}]}],"versions":["3.0pl1-128","3.0pl1-128+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-6.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-6.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-59.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-59.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-59.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0pl1-124ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128ubuntu2+esm1"}]}],"versions":["3.0pl1-127ubuntu1","3.0pl1-128ubuntu1","3.0pl1-128ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128.1ubuntu1.1"}]}],"versions":["3.0pl1-128ubuntu5","3.0pl1-128.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128ubuntu2+esm1"}]}],"versions":["3.0pl1-127ubuntu1","3.0pl1-128ubuntu1","3.0pl1-128ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128.1ubuntu1.1"}]}],"versions":["3.0pl1-128ubuntu5","3.0pl1-128.1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-lp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-lp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cronie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7-86.1"}]}]}],"products":[{"vendor":"cron_project","product":"cron"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://salsa.debian.org/debian/cron/commit/f2525567","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/107373","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DU7HAUAQR4E4AEBPYLUV6FZ4PHKH6A2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9704"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DU7HAUAQR4E4AEBPYLUV6FZ4PHKH6A2/"},{"url":"https://github.com/advisories/GHSA-34r4-h4c9-vmrj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9704","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0157.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24579","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6DU7HAUAQR4E4AEBPYLUV6FZ4PHKH6A2/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191389-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1128935","tags":["report"]},{"url":"https://bugzilla.suse.com/1128937","tags":["report"]},{"url":"https://bugzilla.suse.com/1130746","tags":["report"]},{"url":"https://bugzilla.suse.com/1133100","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9705","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191389-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191990-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9704","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5259-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5259-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9706","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SGQLQRILLJHETNYXAYE7WGS672HK364B/#SGQLQRILLJHETNYXAYE7WGS672HK364B","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9704","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","status":"published","published":"2019-03-12T00:00:00Z","modified":"2024-08-04T21:54:45.181Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19070","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","status":"published","published":"2019-03-12T00:00:00Z","modified":"2024-08-04T21:54:45Z","updated_at":"2026-11-03T03:06:37.634716Z"}],"ghsa":[{"id":"GHSA-34r4-h4c9-vmrj","title":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service ...","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","status":"published","published":"2022-05-13T01:04:45Z","modified":"2023-02-01T05:02:48Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:49:58.498747Z"}],"nvd":[{"id":"CVE-2019-9704","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","status":"published","published":"2019-03-12T01:29:00.24Z","modified":"2026-06-17T02:44:12.37Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-252","CWE-476"],"updated_at":"2026-11-02T14:05:07.268578Z"}],"osv":[{"id":"CVE-2019-9704","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","status":"published","published":"2019-03-12T01:29:00.24Z","modified":"2026-04-16T04:35:54.280799947Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9704","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","status":"published","published":"2019-03-12T01:29:00.24Z","modified":"2026-09-21T07:03:26.582421091Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-9704","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.","status":"published","published":"2019-03-12T01:29:00Z","modified":"2026-02-04T03:47:07.869141Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-1723-1","title":"cron - security update","status":"published","published":"2019-03-21T00:00:00Z","modified":"2026-03-09T01:19:57.350129Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2801-1","title":"cron - security update","status":"published","published":"2021-10-30T00:00:00Z","modified":"2026-03-09T01:20:13.333286Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2019-0157","title":"Updated cronie packages fix security vulnerabilities","description":"Updated cronie packages fix security vulnerabilities:\n\nCronie before 1.5.3 allows local users to cause a denial of service\n(daemon crash) via a large crontab file because the calloc return value\nis not checked (CVE-2019-9704).\n\nCronie before 1.5.3 allows local users to cause a denial of service\n(memory consumption) via a large crontab file because an unlimited number\nof lines is accepted (CVE-2019-9705).\n","status":"published","published":"2019-05-12T09:35:33Z","modified":"2026-04-16T04:42:04.022804397Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1520-1","title":"Security update for cronie","description":"This update for cronie fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9704: Fixed an insufficient check in the return value of calloc which\n  could allow a local user to create Denial of Service by crashing the daemon (bsc#1128937).\n- CVE-2019-9705: Fixed an implementation vulnerability which could allow a local user to\n  exhaust the memory resulting in Denial of Service (bsc#1128935).  \n\nBug fixes:\n\n- Manual start of cron is possible even when it's already started using systemd (bsc#1133100).\n- Cron schedules only one job of crontab (bsc#1130746).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-06-05T15:50:29Z","modified":"2026-02-04T02:20:21.852858Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10701-1","title":"cron-4.2-86.1 on GA media","description":"These are all security issues fixed in the cron-4.2-86.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:24:26.861306Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:1389-1","title":"Security update for cronie","description":"This update for cronie fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9704: Fixed an insufficient check in the return value of calloc which\n  could allow a local user to create Denial of Service by crashing the daemon (bsc#1128937).\n- CVE-2019-9705: Fixed an implementation vulnerability which could allow a local user to\n  exhaust the memory resulting in Denial of Service (bsc#1128935).  \n\nBug fixes:\n\n- Manual start of cron is possible even when it's already started using systemd (bsc#1133100).\n- Cron schedules only one job of crontab (bsc#1130746).\n","status":"published","published":"2019-05-31T08:12:39Z","modified":"2026-02-04T03:14:33.497906Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1389-2","title":"Security update for cronie","description":"This update for cronie fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9704: Fixed an insufficient check in the return value of calloc which\n  could allow a local user to create Denial of Service by crashing the daemon (bsc#1128937).\n- CVE-2019-9705: Fixed an implementation vulnerability which could allow a local user to\n  exhaust the memory resulting in Denial of Service (bsc#1128935).  \n\nBug fixes:\n\n- Manual start of cron is possible even when it's already started using systemd (bsc#1133100).\n- Cron schedules only one job of crontab (bsc#1130746).\n","status":"published","published":"2019-07-03T08:54:41Z","modified":"2026-02-04T03:24:11.168431Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1990-1","title":"Security update for cronie","description":"This update for cronie fixes the following issues:\n\t  \nSecurity issues fixed:\n\n- CVE-2019-9704: Fixed an insufficient check in the return value of calloc which\n  could allow a local user to create Denial of Service by crashing the deamon (bsc#1128937).\n- CVE-2019-9705: Fixed an implementation vulnerability which could allow a local user to\n  exhaust the memory resulting in Denial of Service (bsc#1128935).  \n\nBug fixes:\n\n- Manual start of cron is possible even when it's already started using systemd (bsc#1133100).\n- Cron schedules only one job of crontab (bsc#1130746).\n","status":"published","published":"2019-07-26T12:59:35Z","modified":"2026-02-04T03:01:22.058123Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-5259-1","title":"cron vulnerabilities","description":"It was discovered that the postinst maintainer script in Cron unsafely\nhandled file permissions during package install or update operations.\nAn attacker could possibly use this issue to perform a privilege\nescalation attack. (CVE-2017-9525)\n\nFlorian Weimer discovered that Cron incorrectly handled certain memory\noperations during crontab file creation. An attacker could possibly use\nthis issue to cause a denial of service. (CVE-2019-9704)\n\nIt was discovered that Cron incorrectly handled user input during crontab\nfile creation. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2019-9705)\n\nIt was discovered that Cron contained a use-after-free vulnerability in\nits force_rescan_user function. An attacker could possibly use this issue\nto cause a denial of service. (CVE-2019-9706)\n","status":"published","published":"2022-02-01T14:38:29Z","modified":"2026-06-25T13:31:00.15743463Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5259-2","title":"cron vulnerabilities","description":"USN-5259-1 fixed several vulnerabilities in Cron. This update provides\nthe corresponding update for Ubuntu 18.04 LTS. \n\nOriginal advisory details:\n\n It was discovered that the postinst maintainer script in Cron unsafely\n handled file permissions during package install or update operations.\n An attacker could possibly use this issue to perform a privilege\n escalation attack. (CVE-2017-9525)\n \n Florian Weimer discovered that Cron incorrectly handled certain memory\n operations during crontab file creation. An attacker could possibly use\n this issue to cause a denial of service. (CVE-2019-9704)\n \n It was discovered that Cron incorrectly handled user input during crontab\n file creation. An attacker could possibly use this issue to cause a denial\n of service. (CVE-2019-9705)\n \n It was discovered that Cron contained a use-after-free vulnerability in\n its force_rescan_user function. An attacker could possibly use this issue\n to cause a denial of service. (CVE-2019-9706)\n","status":"published","published":"2022-05-06T08:42:24Z","modified":"2026-04-27T16:02:37.47757Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}