Buffer overflow in Vixie cron 3.0.1-56 and previous versions could allow a local malicious user to gain additional privileges via a long username (> 20 characters).
paul vixie vixie cron