CVE-2016-7032 | High | 7.0 | 2017-04-14 | sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) syst… |
CVE-2014-0106 | | | 2014-03-11 | Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users wit… |
CVE-2013-2777 | | | 2013-04-08 | sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows… |
CVE-2013-2776 | | | 2013-04-08 | sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does n… |
CVE-2013-1776 | | | 2013-04-08 | sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which al… |
CVE-2013-1775 | | | 2013-03-05 | sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain… |
CVE-2012-3440 | | | 2012-08-08 | A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/t… |
CVE-2012-2337 | | | 2012-05-18 | sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to… |
CVE-2012-0809 | | | 2012-02-01 | Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences i… |
CVE-2011-0008 | | | 2011-01-20 | A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file durin… |
CVE-2011-0010 | | | 2011-01-18 | check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid… |
CVE-2010-2956 | | | 2010-09-10 | Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows loc… |
CVE-2010-1646 | | | 2010-06-07 | The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH v… |
CVE-2010-1163 | | | 2010-04-16 | The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a p… |
CVE-2010-0427 | | | 2010-02-25 | sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a s… |
CVE-2010-0426 | | | 2010-02-24 | sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of a… |
CVE-2007-4305 | | | 2007-08-13 | Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interp… |
CVE-2007-3149 | | | 2007-06-11 | sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain p… |
CVE-2006-0151 | | | 2006-01-09 | sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a… |
CVE-2005-4158 | | | 2005-12-11 | Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limi… |
CVE-2005-2959 | | | 2005-10-25 | Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables befo… |
CVE-2005-1993 | | | 2005-06-20 | Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users to gain privileges v… |
CVE-2005-1831 | High | 8.4 | 2005-05-31 | Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local users to gain privileges by using sudo to call su, then entering a blank p… |
CVE-2005-1119 | | | 2005-05-02 | Sudo VISudo 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files. |
CVE-2004-1051 | | | 2005-03-01 | sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as a… |
CVE-2004-1689 | | | 2004-09-16 | sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the… |
CVE-2002-0043 | | | 2002-01-31 | sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by mo… |
CVE-1999-1496 | | | 1999-06-08 | Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a… |
CVE-1999-0958 | | | 1998-01-12 | sudo 1.5.x allows local users to execute arbitrary commands via a .. (dot dot) attack. |