CVE-2024-43688

Name of the Vulnerable Software and Affected Versions vixie cron versions prior to 9cc8ab1 OpenBSD versions 7.4 and 7.5

Description The issue allows a heap-based buffer underflow and memory corruption in cron/entry.c. This was introduced during a May 2023 refactoring.

Recommendations For vixie cron versions prior to 9cc8ab1, update to a version that includes the fix for the heap-based buffer underflow. For OpenBSD versions 7.4 and 7.5, update the vixie cron package to a version that includes the fix for the heap-based buffer underflow. As a temporary workaround, consider restricting access to the set range() function in crontab until a patch is available.