In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of…
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.
CVSS 3.1MEDIUM 5.5·Local·Low privileges·No interaction·EPSS 0.00368·Published 2019-03-12·Will not fixCWE-770
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.
CVSS 3.1MEDIUM 5.5·Local·Low privileges·No interaction·EPSS 0.00365·Published 2019-03-12·Will not fixCWE-252
