CVE-2025-32463_Exploit

CVE-2025-32463Exploit 受危害版本 1.9.14 to 1.9.17 root@kitploit: bash run.sh 成功如下 root@kitploit: neko@aosc-neko205 CVE-2025-32463Exploit@main $ bash run.sh + CVE-2025-32463 Sudo chroot 漏洞复现脚本 正在创建临时工作目录... 工作目录已创建: /tmp/sudoexploit.nc0EjT 正在创建 C 语言 payload woot1337.c... 正在设置 chroot 环境和恶意的...

CVE-2025-32463

CVE-2025-32463 - Sudo Chroot 权限提升漏洞利用 概述 CVE-2025-32463 是 sudo 版本 1.9.14 至 1.9.17 中存在的一个严重本地权限提升漏洞。该漏洞允许具有 sudo 权限的攻击者利用 chroot 选项处理逻辑中的设计缺陷，将权限提升至 root。 漏洞详情 CVE ID : CVE-2025-32463 受影响版本 : sudo 1.9.14 - 1.9.17 漏洞类型 : 本地权限提升 Local Privilege Escalation, LPE 严重性 : 严重 已修复版本 : sudo 1.9.17p1 及更高版本 技术...

CVE-2025-32463-EXPLOIT

Xpl0it — Sudo NSS Library Hijack | v0.0.4 Author: 0xb0rn3 | 0xbv1 Type: Proof of Concept PoC Security Research Tool CVE: CVE-2023-42456 Technique: sudo -R chroot NSS library injection → privilege escalation to root ⚠️ Disclaimer This tool is developed for authorized penetration testing and...

CVE-2025-32463-EXPLOIT

CVE-2025-32463 - Sudo 权限提升 sudo 中存在一个影响 Linux/Unix 系统的权限提升漏洞。该缺陷源于当 sudo 与 -R（--chroot）选项一起使用时存在不正确的路径验证 ，允许攻击者通过恶意 NSS 库加载来提升至 root 权限。 根本原因 当 sudo 在 chroot 环境 （-R 选项）内执行命令时，它在错误条件下错误处理了 NSS（名称服务开关）库加载 。 不正确的路径验证（例如，未能清理 LDLIBRARYPATH 或 /etc/nsswitch.conf 中的路径）可能导致加载恶意库 而不是合法的 NSS 库（例如...

CIFSwitch

CIFSwitch CVE-2026-46243 Writeup !WARNING 该 PoC 仅用于帮助防御者、维护者及获得授权的安全团队，在其拥有或明确获准测试的系统上验证补丁、缓解措施、检测规则及暴露面。 您需自行确保对此材料的使用是合法、经授权、可控的，并在隔离的测试环境中进行。 说明 需要 GCC —— 该 PoC 构建了两个内联的 C 辅助程序：一个伪造的 NSS 库（用于写入 sudoers.d 条目）和一个触发器，用于让 cifs.upcall 进入 PoC 的私有命名空间并加载该伪造的 NSS 库。 该 PoC 假定使用常见的 x8664 NSS 模块目录 ——...

CVE-2025-32463-POC

CVE-2025-32463 - sudo Local Privilege Escalation PoC ⚠️ This repository contains a Proof of Concept PoC exploit for CVE-2025-32463 Intended only for educational purposes and use in authorized environments. 🧠 About the Vulnerability CVE-2025-32463 is a local privilege escalation vulnerability...

CVE-2025-32463

📌 CVE-2025-32463 — Sudo --chroot 本地权限提升 ExploitDB ID: 52352 🧠 概述 本仓库记录了一个影响 Sudo 1.9.14 – 1.9.17 版本的严重 本地权限提升（LPE） 漏洞。 该漏洞源于 sudo -R --chroot 选项的错误实现，即使 sudoers 文件中未授权 ，攻击者也能 以 root 权限执行命令 。 🔥 结果： 未授权用户 → root shell 🧩 受影响组件 软件： sudo 受影响版本： 1.9.14 1.9.15 1.9.16 1.9.17 CVE ID： CVE-2025-32463 平台：...

CVE-2025-32462_32463-Lab

CVE-2025-32462 & CVE-2025-32463 – PoC 实验室 这是一个基于容器的实验室和 PoC，针对 sudo 中的以下漏洞： CVE-2025-32462 – sudo -h 主机匹配逻辑绕过 CVE-2025-32463 – sudo -R chroot NSS 库逃逸 🔒 仅供教育用途。请勿在您不拥有或无权限测试的系统上使用。 🔬 原始研究 CVE-2025-32462 相关博文：sudo 主机别名权限提升 CVE-2025-32463 相关博文：sudo chroot NSS 绕过 🧠 研究致谢 Rich Mirch Stratascale Cyber...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, NSS

After accepting an untrusted certificate, handling an empty PKCS7 sequence as part of the certificate data could have led to a crash. This crash is believed to be exploitable. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

Astra Linux – Vulnerability in Firefox and Thunderbird

Another issue in the Libraries component of NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

[SECURITY] [DSA 6403-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6403-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 29, 2026 https://www.debian.org/security/faq -...

The vulnerability in the NSS library used by Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to cause a service failure.

The vulnerability in the NSS library used by Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-12318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. CVE-2026-12318 Note that Nessu...

Updated nspr, nss and firefox(-l10n) packages fix security issues

The updated packages fix security vulnerabilities: Incorrect boundary conditions in the Audio/Video: Web Codecs component. CVE-2026-8946 Incorrect boundary conditions in the JavaScript Engine: JIT component. CVE-2026-8388 Use-after-free in the DOM: Bindings WebIDL component. CVE-2026-8947 Other...

RockyLinux 9 : firefox (RLSA-2026:19201)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19201 advisory. firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS CVE-2026-6772 firefox: thunderbird: Use-after-free in the JavaScri...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2026-1703)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1703 advisory. Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. CVE-2026-6766 Other...

AlmaLinux 10 : thunderbird (ALSA-2026:12285)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:12285 advisory. firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS CVE-2026-6772 firefox: thunderbird: Use-after-free in the JavaScri...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2026:1650-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1650-1 advisory. This update for MozillaFirefox fixes the following issue: Update to Firefox Extended Support Release 140.10.0 ESR bsc1262230, MFSA 2026-32: -...

UBUNTU-CVE-2026-6766

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

Linux Distros Unpatched Vulnerability : CVE-2026-6772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbir...