Summary
Jakub Wilk and Stephane Chazelas discovered that Sudo incorrectly handled
the TZ environment variable. An attacker with Sudo access could possibly
use this issue to open arbitrary files, bypassing intended permissions.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | sudo | 1.8.9p5-1ubuntu1.1 |
Vulnerabilities 1
-
Unscored —
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows lo…
References
-
report
https://ubuntu.com/security/CVE-2014-9680