CVE-2019-9705 Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.
MediumCVSS 5.5
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cron(Debian:12) | < 3.0pl1-133 | 3.0pl1-133 |
| debian/cron(Debian:13) | < 3.0pl1-133 | 3.0pl1-133 |
| debian/cron(Debian:14) | < 3.0pl1-133 | 3.0pl1-133 |
| cron project cron | < 3.0pl1-133 | 3.0pl1-133 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| fedoraproject fedora | = 29 | No fix listed |
References
- Debian Security Tracker CVE-2019-9705 vendor-advisory
- 107378 third-party-advisory vdb-entry
- [debian-lts-announce] 20190321 [SECURITY] [DLA 1723-1] cron security update mailing-list third-party-advisory
- [debian-lts-announce] 20211030 [SECURITY] [DLA 2801-1] cron security update mailing-list third-party-advisory
- FEDORA-2019-7104a00054 vendor-advisory
- salsa.debian.org patch third-party-advisory