Bugzilla – Bug 1128937
VUL-1: CVE-2019-9704: cron,cronie: vixie-cron: calloc return value resulting in remote dos
Last modified: 2024-05-07 09:14:48 UTC
Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked. Upstream commit: https://salsa.debian.org/debian/cron/commit/f2525567 References: https://bugzilla.redhat.com/show_bug.cgi?id=1687688 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9704
Both cron (SLE-10 & SLE-11) as well as cronie (SLE-12 & SLE-15) contain the affected code. Not a huge issue, VUL-1 for now, so no immediate action required.
SUSE-SU-2019:1389-1: An update that solves two vulnerabilities and has two fixes is now available. Category: security (low) Bug References: 1128935,1128937,1130746,1133100 CVE References: CVE-2019-9704,CVE-2019-9705 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): cronie-1.5.1-6.7.1 SUSE Linux Enterprise Module for Basesystem 15 (src): cronie-1.5.1-6.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:1520-1: An update that solves two vulnerabilities and has two fixes is now available. Category: security (low) Bug References: 1128935,1128937,1130746,1133100 CVE References: CVE-2019-9704,CVE-2019-9705 Sources used: openSUSE Leap 15.1 (src): cronie-1.5.1-lp151.4.3.1 openSUSE Leap 15.0 (src): cronie-1.5.1-lp150.3.3.1
SUSE-SU-2019:1389-2: An update that solves two vulnerabilities and has two fixes is now available. Category: security (low) Bug References: 1128935,1128937,1130746,1133100 CVE References: CVE-2019-9704,CVE-2019-9705 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): cronie-1.5.1-6.7.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): cronie-1.5.1-6.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1990-1: An update that solves two vulnerabilities and has two fixes is now available. Category: security (low) Bug References: 1128935,1128937,1130746,1133100 CVE References: CVE-2019-9704,CVE-2019-9705 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): cronie-1.4.11-59.10.1 SUSE Linux Enterprise Desktop 12-SP4 (src): cronie-1.4.11-59.10.1 SUSE CaaS Platform 3.0 (src): cronie-1.4.11-59.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
All done, closing.