What is CVE-2013-2777?

CVE-2013-2777 is a vulnerability in Apple Mac OS X, classified under CWE-264. Published 2013-04-08.

Is CVE-2013-2777 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apple Mac OS X

CVE-2013-2777

sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.

Published 2013-04-08 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 4.4 (Medium). Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.004 (29.0th percentile), scored 2026-10-24.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 29.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Apple Mac OS X
Todd Miller Sudo — versions 1.3.5, 1.6, 1.6.1

Weakness classification (CWE)

CWE-264

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

www.sudo.ws/repos/sudo/rev/bfa23f089bba (Vendor Advisory)
www.securityfocus.com/bid/58207 (vdb-entry)
bugs.debian.org/cgi-bin/bugreport.cgi
www.sudo.ws/repos/sudo/rev/2f3225a2a4a4 (Vendor Advisory)
rhn.redhat.com/errata/RHSA-2013-1701.html (vendor-advisory)
www.debian.org/security/2013/dsa-2642 (vendor-advisory)
www.openwall.com/lists/oss-security/2013/02/27/31 (mailing-list)
www.sudo.ws/sudo/alerts/tty_tickets.html (Vendor Advisory)
lists.apple.com/archives/security-announce/2015/Aug/msg00001.html (vendor-advisory)
www.slackware.com/security/viewer.php (vendor-advisory)

Frequently asked questions

What is CVE-2013-2777?: CVE-2013-2777 is a vulnerability in Apple Mac OS X, classified under CWE-264. Published 2013-04-08.
Is CVE-2013-2777 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.