CVE catalog

CVE-2016-3992

cronic: CVE-2016-3992

Severity: Medium · CVSS 6.2CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: Jul 26, 2016, 5:59:01 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 25, 2026

cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /tmp.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	cronic	sid	`3-2.1`	fixed
Debian	cronic	forky	`3-2.1`	fixed
Debian	cronic	trixie	`3-2.1`	fixed
Debian	cronic	bookworm	`3-2.1`	fixed
Opensuse	cronic	tumbleweed	`3-1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	cronic	source	sid	`3-1`	not yet assigned	Not reported	[820331]
Debian	cronic	source	forky	`3-1`	not yet assigned	Not reported	[820331]
Debian	cronic	source	trixie	`3-1`	not yet assigned	Not reported	[820331]
Debian	cronic	source	bookworm	`3-1`	not yet assigned	Not reported	[820331]
Opensuse	cronic	rpm	tumbleweed	`3-1.2`	Not reported	OPENSUSE-SU-2024:10384-1	Not reported

[Debian bug #820331]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[cronic]Fixed
Details (2)
- 3-2.1 · all · bookworm
  Fixed · Fixed: 3-1
  dsa · cronic · debian · bookworm; dsa · cronic · debian · 12
- 3-2.1 · all · bookworm
  Fixed · Fixed: 3-1
  dsa · cronic · debian · bookworm; dsa · cronic · debian · 12

[Debian 13 (Trixie)]

[cronic]Fixed
Details (2)
- 3-2.1 · all · trixie
  Fixed · Fixed: 3-1
  dsa · cronic · debian · 13
- 3-2.1 · all · trixie
  Fixed · Fixed: 3-1
  dsa · cronic · debian · 13

[openSUSE Tumbleweed]

[cronic]Fixed
Source package: [cronic]
Details (1)
- 3-1.24 · noarch · tumbleweed
  Fixed · Fixed: 3-1.2
  dsa · cronic · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:21:18 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]