CVE-2019-9706: Use After Free
Published Dec 27, 2015
·Updated
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a forcerescanuser error.
Affected Software
100 affected components
debian/cron<=3.0pl1-127+deb8u1, <=3.0pl1-124
Debian Cron=3.0
Debian Cron=3.0-pl1
Debian Cron=3.0-pl1-100
Debian Cron=3.0-pl1-101
Debian Cron=3.0-pl1-102
Debian Cron=3.0-pl1-103
Debian Cron=3.0-pl1-104
Debian Cron=3.0-pl1-105
Debian Cron=3.0-pl1-106
Debian Cron=3.0-pl1-107
Debian Cron=3.0-pl1-108
Debian Cron=3.0-pl1-109
Debian Cron=3.0-pl1-110
Debian Cron=3.0-pl1-111
Debian Cron=3.0-pl1-112
Debian Cron=3.0-pl1-113
Debian Cron=3.0-pl1-114
Debian Cron=3.0-pl1-115
Debian Cron=3.0-pl1-116
Debian Cron=3.0-pl1-117
Debian Cron=3.0-pl1-118
Debian Cron=3.0-pl1-119
Debian Cron=3.0-pl1-120
Debian Cron=3.0-pl1-121
Debian Cron=3.0-pl1-122
Debian Cron=3.0-pl1-123
Debian Cron=3.0-pl1-124
Debian Cron=3.0-pl1-124.1
Debian Cron=3.0-pl1-124.2
Debian Cron=3.0-pl1-125
Debian Cron=3.0-pl1-126
Debian Cron=3.0-pl1-127
Debian Cron=3.0-pl1-128
Debian Cron=3.0-pl1-130
Debian Cron=3.0-pl1-131
Debian Cron=3.0-pl1-132
Debian Cron=3.0-pl1-37
Debian Cron=3.0-pl1-38
Debian Cron=3.0-pl1-39
Debian Cron=3.0-pl1-40
Debian Cron=3.0-pl1-41
Debian Cron=3.0-pl1-42
Debian Cron=3.0-pl1-43
Debian Cron=3.0-pl1-44
Debian Cron=3.0-pl1-45
Debian Cron=3.0-pl1-46
Debian Cron=3.0-pl1-47
Debian Cron=3.0-pl1-48
Debian Cron=3.0-pl1-49
Debian Cron=3.0-pl1-50
Debian Cron=3.0-pl1-50.1
Debian Cron=3.0-pl1-50.2
Debian Cron=3.0-pl1-51
Debian Cron=3.0-pl1-53
Debian Cron=3.0-pl1-54
Debian Cron=3.0-pl1-55
Debian Cron=3.0-pl1-56
Debian Cron=3.0-pl1-57
Debian Cron=3.0-pl1-57.2
Debian Cron=3.0-pl1-57.3
Debian Cron=3.0-pl1-58
Debian Cron=3.0-pl1-59
Debian Cron=3.0-pl1-60
Debian Cron=3.0-pl1-61
Debian Cron=3.0-pl1-62
Debian Cron=3.0-pl1-63
Debian Cron=3.0-pl1-64
Debian Cron=3.0-pl1-65
Debian Cron=3.0-pl1-66
Debian Cron=3.0-pl1-67
Debian Cron=3.0-pl1-68
Debian Cron=3.0-pl1-69
Debian Cron=3.0-pl1-70
Debian Cron=3.0-pl1-71
Debian Cron=3.0-pl1-72
Debian Cron=3.0-pl1-73
Debian Cron=3.0-pl1-74
Debian Cron=3.0-pl1-75
Debian Cron=3.0-pl1-76
Debian Cron=3.0-pl1-77
Debian Cron=3.0-pl1-78
Debian Cron=3.0-pl1-79
Debian Cron=3.0-pl1-80
Debian Cron=3.0-pl1-81
Debian Cron=3.0-pl1-82
Debian Cron=3.0-pl1-83
Debian Cron=3.0-pl1-84
Debian Cron=3.0-pl1-85
Debian Cron=3.0-pl1-86
Debian Cron=3.0-pl1-87
Debian Cron=3.0-pl1-88
Debian Cron=3.0-pl1-89
Debian Cron=3.0-pl1-90
Debian Cron=3.0-pl1-91
Debian Cron=3.0-pl1-92
Debian Cron=3.0-pl1-93
Debian Cron=3.0-pl1-94
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Patch Available
Event History
Mar 12, 2019
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:29 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-9706?
CVE-2019-9706 is classified as a denial of service vulnerability due to a use-after-free error leading to daemon crashes.
2
How do I fix CVE-2019-9706?
To fix CVE-2019-9706, update Vixie Cron to version 3.0pl1-128 or later on Debian systems.
3
Who is affected by CVE-2019-9706?
CVE-2019-9706 affects local users of Vixie Cron, specifically versions prior to 3.0pl1-128 on Debian systems.
4
What systems are vulnerable to CVE-2019-9706?
The vulnerable systems are those running Vixie Cron versions 3.0pl1-127 and below on Debian.
5
What type of attacks can exploit CVE-2019-9706?
CVE-2019-9706 can be exploited by local users to crash the cron daemon, resulting in denial of service.