Medium severity6.7NVD Advisory· Published Jun 9, 2017· Updated May 13, 2026
CVE-2017-9525
CVE-2017-9525
Description
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
Affected products
3cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- bugs.debian.org/864466nvdIssue TrackingThird Party AdvisoryVendor Advisory
- www.openwall.com/lists/oss-security/2017/06/08/3nvdMailing ListThird Party Advisory
- www.securitytracker.com/id/1038651nvdThird Party AdvisoryVDB Entry
- lists.debian.org/debian-lts-announce/2019/03/msg00025.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/10/msg00029.htmlnvdMailing ListThird Party Advisory
News mentions
0No linked articles in our index yet.