While scanning /etc/cron.d, cron prefixes each accepted filename with
"*system*" in a fixed-size fname buffer using strcpy()/strcat(). A
valid maximum-length directory entry can exceed the remaining buffer
capacity and overwrite stack memory. On the usual filesystem this
requires creating a long name in the root-controlled /etc/cron.d
directory, so this is a hardening and reliability issue; no
unprivileged control or privilege escalation was demonstrated.

The attached Debian -212 patch uses checked snprintf() construction
for both the prefixed internal name and the path, and skips an entry
that does not fit. Its regression test covers exact accepted and
first-rejected filename/path boundaries.

The patched Debian source built in a disposable trixie container; the
focused regression and all 13 existing Debian integration tests
passed. Ubuntu versions 3.0pl1-200ubuntu1 and -209ubuntu1 have the
same issue. Debian and Ubuntu Security Teams recommended public bug
reports.

Regards,
Brett Sutton