Vulnerability Database

300,926

Total vulnerabilities in the database

CVE-2017-9525

In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.

  • Published: Jun 9, 2017
  • Updated: Nov 9, 2025
  • CVE: CVE-2017-9525
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.7
  • AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 6.9
  • AV:L/AC:M/Au:N/C:C/I:C/A:C

CWEs:

Software From Fixed in
cron_project / cron - 3.0pl1-128..x
debian / debian_linux 8.0 8.0.x
debian / debian_linux 9.0 9.0.x