{"id":"CVE-2019-9706","aliases":["DEBIAN-CVE-2019-9706","DLA-1723-1","DLA-2801-1","EUVD-2019-19072","GHSA-vvgw-8mjp-fp2r","UBUNTU-CVE-2019-9706","USN-5259-1","USN-5259-2"],"status":"published","title":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service ...","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0046,"percentile":0.40098,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2019-03-12T00:00:00Z","modified":"2026-09-21T07:03:26Z","fixes":[{"ecosystem":"Debian:12","package":"cron","fixed_in":["3.0pl1-133"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cron","fixed_in":["3.0pl1-133"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cron","fixed_in":["3.0pl1-133"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","fixed_in":["3.0pl1-128ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cron","fixed_in":["3.0pl1-128.1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-133"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-133"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-133"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-127+deb8u2"}]}],"versions":["3.0pl1-127","3.0pl1-127+deb8u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:9","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128+deb9u2"}]}],"versions":["3.0pl1-128","3.0pl1-128+deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0pl1-124ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128ubuntu2+esm1"}]}],"versions":["3.0pl1-127ubuntu1","3.0pl1-128ubuntu1","3.0pl1-128ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128.1ubuntu1.1"}]}],"versions":["3.0pl1-128ubuntu5","3.0pl1-128.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128ubuntu2+esm1"}]}],"versions":["3.0pl1-127ubuntu1","3.0pl1-128ubuntu1","3.0pl1-128ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0pl1-128.1ubuntu1.1"}]}],"versions":["3.0pl1-128ubuntu5","3.0pl1-128.1ubuntu1"],"bundled":4}],"products":[{"vendor":"debian","product":"cron"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://salsa.debian.org/debian/cron/commit/40791b93","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Vendor Advisory","evidence","report"]},{"url":"https://packages.qa.debian.org/c/cron/news/20190311T170403Z.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9706"},{"url":"https://github.com/advisories/GHSA-vvgw-8mjp-fp2r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9706","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9706","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5259-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5259-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9705","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-9706","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","status":"published","published":"2019-03-12T00:00:00Z","modified":"2024-08-04T21:54:45.173Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19072","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","status":"published","published":"2019-03-12T00:00:00Z","modified":"2024-08-04T21:54:45Z","updated_at":"2026-11-03T03:06:37.634716Z"}],"ghsa":[{"id":"GHSA-vvgw-8mjp-fp2r","title":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service ...","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","status":"published","published":"2022-05-13T01:04:47Z","modified":"2023-02-01T05:02:48Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:49:58.498747Z"}],"nvd":[{"id":"CVE-2019-9706","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","status":"published","published":"2019-03-12T01:29:00.317Z","modified":"2026-06-17T02:44:12.613Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:05:07.268578Z"}],"osv":[{"id":"CVE-2019-9706","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","status":"published","published":"2019-03-12T01:29:00.317Z","modified":"2026-03-15T22:29:59.64502Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9706","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","status":"published","published":"2019-03-12T01:29:00.317Z","modified":"2026-09-21T07:03:26.197211768Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-9706","description":"Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.","status":"published","published":"2019-03-12T01:29:00Z","modified":"2026-02-04T02:21:12.057864Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-1723-1","title":"cron - security update","status":"published","published":"2019-03-21T00:00:00Z","modified":"2026-03-09T01:19:57.350129Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2801-1","title":"cron - security update","status":"published","published":"2021-10-30T00:00:00Z","modified":"2026-03-09T01:20:13.333286Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"USN-5259-1","title":"cron vulnerabilities","description":"It was discovered that the postinst maintainer script in Cron unsafely\nhandled file permissions during package install or update operations.\nAn attacker could possibly use this issue to perform a privilege\nescalation attack. (CVE-2017-9525)\n\nFlorian Weimer discovered that Cron incorrectly handled certain memory\noperations during crontab file creation. An attacker could possibly use\nthis issue to cause a denial of service. (CVE-2019-9704)\n\nIt was discovered that Cron incorrectly handled user input during crontab\nfile creation. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2019-9705)\n\nIt was discovered that Cron contained a use-after-free vulnerability in\nits force_rescan_user function. An attacker could possibly use this issue\nto cause a denial of service. (CVE-2019-9706)\n","status":"published","published":"2022-02-01T14:38:29Z","modified":"2026-06-25T13:31:00.15743463Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5259-2","title":"cron vulnerabilities","description":"USN-5259-1 fixed several vulnerabilities in Cron. This update provides\nthe corresponding update for Ubuntu 18.04 LTS. \n\nOriginal advisory details:\n\n It was discovered that the postinst maintainer script in Cron unsafely\n handled file permissions during package install or update operations.\n An attacker could possibly use this issue to perform a privilege\n escalation attack. (CVE-2017-9525)\n \n Florian Weimer discovered that Cron incorrectly handled certain memory\n operations during crontab file creation. An attacker could possibly use\n this issue to cause a denial of service. (CVE-2019-9704)\n \n It was discovered that Cron incorrectly handled user input during crontab\n file creation. An attacker could possibly use this issue to cause a denial\n of service. (CVE-2019-9705)\n \n It was discovered that Cron contained a use-after-free vulnerability in\n its force_rescan_user function. An attacker could possibly use this issue\n to cause a denial of service. (CVE-2019-9706)\n","status":"published","published":"2022-05-06T08:42:24Z","modified":"2026-04-27T16:02:37.47757Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}