Aggregates CVE and security vulnerability intelligence across all cron_project-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk path handling and vendor risk memory corruption and related problems; some flaws may lead to vendor impact application crash and vendor impact file overwrite.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2019-9705 | Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted. | [email protected] | 5.5 | 0.17% | 2019-03-12 | 2024-11-21 |
| CVE-2019-9704 | Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked. | [email protected] | 5.5 | 0.17% | 2019-03-12 | 2024-11-21 |
| CVE-2017-9525 | In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. | [email protected] | 6.7 | 0.06% | 2017-06-09 | 2026-05-13 |