Astra Linux – Vulnerability in sudo

In Sudo before 1.9.12p2, the sudoedit also known as -e feature improperly handles additional arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR. This allows a local attacker to append arbitrary entries to the list of files to process. This can lead to...

CLSA-2023-1675985571 sudo: Fix of CVE-2023-22809

CVE-2023-22809: do not permit editor arguments to include "--" for sudoedit - build tests have been enabled...

AZL-35101 CVE-2018-1000156 affecting package patch for versions less than 2.7.6-9

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...