CVE-2019-9704: Null Pointer Dereference
Published Mar 12, 2019
·Updated
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.
Affected Software
4 affected components
Cron Project Cron<3.0pl1-133
Fedoraproject Fedora=29
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Patch Available
Event History
Mar 12, 2019
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:29 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-9704?
CVE-2019-9704 is classified as a medium severity vulnerability due to its potential to cause denial of service.
2
How do I fix CVE-2019-9704?
To fix CVE-2019-9704, upgrade to a version of Vixie Cron that is 3.0pl1-133 or later.
3
What systems are affected by CVE-2019-9704?
CVE-2019-9704 affects Vixie Cron versions prior to 3.0pl1-133, specifically on Debian 8.0, Debian 9.0, and Fedora 29.
4
What type of attack does CVE-2019-9704 facilitate?
CVE-2019-9704 allows local users to execute a denial of service attack by crashing the cron daemon.
5
How can I identify if my system is vulnerable to CVE-2019-9704?
You can determine if your system is vulnerable to CVE-2019-9704 by checking the version of Vixie Cron installed on your system.