Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
sudo project vulnerabilities and exploits
(subscribe to this query)
7
CVSSv3
CVE-2015-8239
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.
Sudo Project Sudo 1.8.15
Sudo Project Sudo 1.8.14
Sudo Project Sudo 1.8.13
Sudo Project Sudo 1.8.12
Sudo Project Sudo 1.8.10
Sudo Project Sudo 1.8.9
Sudo Project Sudo 1.8.11
Sudo Project Sudo 1.8.8
1 Github repository
8.2
CVSSv3
CVE-2017-1000368
Todd Miller's sudo version 1.8.20p1 and previous versions is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.
Sudo Project Sudo 1.8.20
Sudo Project Sudo
2 Github repositories
7.1
CVSSv3
CVE-2022-43995
Sudo 1.8.0 up to and including 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password...
Sudo Project Sudo 1.9.12
Sudo Project Sudo
6.4
CVSSv3
CVE-2017-1000367
Todd Miller's sudo version 1.8.20 and previous versions is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
Sudo Project Sudo
1 EDB exploit
4 Github repositories
NA
CVE-2015-5602
sudoedit in Sudo prior to 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."
Sudo Project Sudo
1 EDB exploit
2 Github repositories
7
CVSSv3
CVE-2019-18684
Sudo up to and including 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race condition between determining a uid, and the setresuid and openat system calls. The attacker can write "AL...
Sudo Project Sudo
7
CVSSv3
CVE-2023-42465
Sudo prior to 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
Sudo Project Sudo
8.8
CVSSv3
CVE-2023-7090
A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.
Sudo Project Sudo
7.2
CVSSv3
CVE-2023-27320
Sudo prior to 1.9.13p2 has a double free in the per-command chroot feature.
Sudo Project Sudo 1.9.13
Sudo Project Sudo
Fedoraproject Fedora 36
Fedoraproject Fedora 37
Fedoraproject Fedora 38
7.8
CVSSv3
CVE-2023-22809
In Sudo prior to 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local malicious user to append arbitrary entries to the list of files to process. This can lead to p...
Sudo Project Sudo 1.9.12
Sudo Project Sudo
Debian Debian Linux 10.0
Debian Debian Linux 11.0
Fedoraproject Fedora 36
Fedoraproject Fedora 37
Apple Macos
11 Github repositories
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-33572
CVE-2024-24919
CVE-2024-0230
CVE-2024-32714
HTML injection
local file inclusion
CVE-2024-31098
CVE-2024-31244
privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »