CVE-2019-9704 Null dereference in n/a
Local users can crash the Vixie Cron daemon by submitting a large crontab file due to unchecked memory allocation failures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-9704?
CVE-2019-9704 is a medium-severity vulnerability in Debian Debian Linux, published on 12 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.
Which versions are affected by CVE-2019-9704?
It affects 3 products.
Linux distribution packages (1)
cronie openSUSE:Tumbleweed | All versions | 1.5.7-86.1 |
Products include Cron Project Cron, Debian Debian Linux, Fedoraproject Fedora.
How do I fix CVE-2019-9704?
Apply the vendor's patch.
Is CVE-2019-9704 being exploited?
There is no known exploitation of CVE-2019-9704 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-9704, GHSA-34r4-h4c9-vmrj, UBUNTU-CVE-2019-9704, openSUSE-SU-2024:10701-1.