DEBIAN-CVE-2006-2607

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2006-2607
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-2607.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2006-2607
Upstream
Published
2006-05-25T20:02:00Z
Modified
2026-09-12T06:47:26Z
Summary
[none]
Details

do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in /etc/security/limits.conf.

References

Affected packages

Debian:12 / cron

Package

Name
cron
Purl
pkg:deb/debian/cron?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0pl1-64

Ecosystem specific 

{
    "urgency": "medium"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-2607.json"

Debian:13 / cron

Package

Name
cron
Purl
pkg:deb/debian/cron?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0pl1-64

Ecosystem specific 

{
    "urgency": "medium"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-2607.json"

Debian:14 / cron

Package

Name
cron
Purl
pkg:deb/debian/cron?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0pl1-64

Ecosystem specific 

{
    "urgency": "medium"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-2607.json"