49 results · Feed
-
High 7.8CVE-2026-96512 Public exploit
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Bec…
-
High 7.8CVE-2026-82474 Public exploit
Sudo through 1.9.17p2 Intercept Policy Bypass via execveat
Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enf…
-
High 7.4
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop befo…
-
Critical 9.3
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directo…
KEV Sep 29, 2025 -
Low 2.8CVE-2025-32462 Public exploit
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, all…
-
Medium 6.6
Sudo: improper handling of ipa_hostname leads to privilege mismanagement
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after ret…
-
Unscored —
Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because applicati…
-
Unscored —
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
-
Unscored —
Sudo before 1.9.13 does not escape control characters in log messages.
-
High 7.2
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
-
High 7.8
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…
-
High 7.1
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bou…
-
High 7.8
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privileg…
KEV Apr 6, 2022 -
Unscored —
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and e…
-
Unscored —
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existe…
-
Unscored —
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the…
-
Unscored —
In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by inv…
-
Unscored —
In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instea…
-
Unscored —
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The …
-
Unscored —
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and s…
-
Medium 6.4
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo execu…
-
Unscored —CVE-2015-8239 Public exploit
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts o…
-
Unscored —
Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_pro…
-
Unscored —CVE-2017-1000367 Public exploit
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process…
-
Unscored —
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows lo…
-
Unscored —
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions vi…
-
Unscored —CVE-2015-5602 Public exploit
sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is …
-
Unscored —
Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete r…
-
Unscored —
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate t…
-
Unscored —
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function wit…
-
Unscored —
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the c…
-
Unscored —CVE-2013-1775 Public exploit
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypa…
-
Unscored —
sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netm…
-
Unscored —CVE-2012-0809 Public exploit
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbi…
-
Unscored —
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command executi…
-
Unscored —
Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunct…
-
Unscored —
The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an e…
-
Unscored —
The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current wo…
-
Unscored —
sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allow…
-
Unscored —CVE-2010-0426 Public exploit
sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name…