Summary
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)
It was discovered that the Protobuf-c library, used by Sudo, incorrectly
handled certain arithmetic shifts. An attacker could possibly use this
issue to cause Sudo to crash, resulting in a denial of service. This issue
only affected Ubuntu 22.04 LTS. (CVE-2022-33070)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | sudo | 1.8.21p2-3ubuntu1.5 |
| Ubuntu · 20.04 LTS 20.04:LTS | sudo | 1.8.31-1ubuntu1.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | sudo | 1.9.9-1ubuntu2.2 |
Vulnerabilities 2
-
High 7.8
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…
-
Unscored —
Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in prot…