Description
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cron | 3.0pl1-129 | — |
| Debian 14 | systemd-cron | 1.5.17-2 | — |
| Debian 13 | cron | 3.0pl1-129 | — |
| Debian 13 | systemd-cron | 1.5.17-2 | — |
| Debian 12 | cron | 3.0pl1-129 | — |
| Debian 12 | systemd-cron | 1.5.17-2 | — |
| Debian 9 | cron | 3.0pl1-128+deb9u2 | DLA-2801-1 |
| Debian 8 | cron | 3.0pl1-127+deb8u2 | DLA-1723-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | cron | 3.0pl1-128.1ubuntu1.2 | USN-5259-3, USN-5259-2 |
| Ubuntu 14.04 LTS | cron | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | cron | 3.0pl1-128ubuntu2+esm2 | USN-5259-3, USN-5259-1 |
Advisories 5
- USN-5259-1 cron vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5259-3 cron regression Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5259-2 cron vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2801-1 cron - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1723-1 cron - security update Debian Security (DSA / DLA) · Mar 9, 2026