In this paper, we investigate the physical-layer security of a multi-user multi-eavesdropper cognitive radio system, which is composed of multiple cognitive users (CUs) transmitting to a common cognitive base station (CBS), while multiple eavesdroppers may collaborate with each other or perform independently in intercepting the CUs-CBS transmissions, which are called the coordinated and uncoordinated eavesdroppers, respectively. Considering multiple CUs available, we propose the round-robin scheduling as well as the optimal and suboptimal user scheduling schemes for improving the security of CUs-CBS transmissions against eavesdropping attacks. Specifically, the optimal user scheduling is designed by assuming that the channel state information (CSI) of all links from CUs to CBS, to primary user (PU) and to eavesdroppers are available. By contrast, the suboptimal user scheduling only requires the CSI of CUs-CBS links without the PU's and eavesdroppers' CSI. We derive closed-form expressions of the secrecy outage probability of these three scheduling schemes in the presence of the coordinated and uncoordinated eavesdroppers. We also carry out the secrecy diversity analysis and show that the round-robin scheduling achieves the diversity order of only one, whereas the optimal and suboptimal scheduling schemes obtain the full secrecy diversity, no matter whether the eavesdroppers collaborate or not. In addition, numerical secrecy outage results demonstrate that for both the coordinated and uncoordinated eavesdroppers, the optimal user scheduling achieves the best security performance and the round-robin scheduling performs the worst. Finally, upon increasing the number of CUs, the secrecy outage probabilities of the optimal and suboptimal user scheduling schemes both improve significantly.