Medium severity6.7NVD Advisory· Published Jun 9, 2017· Updated Jun 17, 2026

CVE-2017-9525

Description

In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cron Project/Cron
cpe:2.3:a:cron_project:cron:*:*:*:*:*:*:*:*
Range: <=3.0pl1-128.
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Vixie/Cronllm-fuzzy
Range: <=3.0pl1-128

Patches

Vulnerability mechanics

References

bugs.debian.org/864466nvdIssue TrackingThird Party AdvisoryVendor Advisory
www.openwall.com/lists/oss-security/2017/06/08/3nvdMailing ListThird Party Advisory
www.securitytracker.com/id/1038651nvdThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2019/03/msg00025.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2021/10/msg00029.htmlnvdMailing ListThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.436
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000