sudo security update

1.8.6p3-29.0.4.el610.3 - Fixed Privilege escalation CVE-2023-22809 for sudoedit Orabug: 35037922...

CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

CVE-2023-27320

CVE-2023-27320 affects sudo and is caused by a double-free in the per-command chroot feature. Public advisories indicate affected versions include sudo before 1.9.13p2 (and related subversions such as 1.9.12p2‑1 in some advisories) with fixes in newer releases. Affected platforms include Linux di...

Sudo 资源管理错误漏洞

Sudo is a program used on Unix-like systems that allows users to execute commands with special privileges in a secure manner. A security vulnerability exists in versions prior to Sudo 1.9.13p2, which stems from the presence of a double release vulnerability...

CVE-2023-27320

Sudo before 1.9.13p2 has a double free in the per-command chroot feature...

CVE-2023-22809 affecting package sudo for versions less than 1.9.12p2-1

CVE-2023-22809 affecting package sudo for versions less than 1.9.12p2-1. An upgraded version of the package is available that resolves this issue...

PT-2023-35540 · Sudo · Sudo

Name of the Vulnerable Software and Affected Versions: sudo affected versions not specified Description: The issue is related to a crash type of UNKNOWN WRITE. The crash state involves functions such as sudo lbuf append quoted v1 and sudoers format member int. Recommendations: At the moment, ther...

USN-5811-1: Sudo vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly handled user-specified editors when using the sudoedit command. A local attacker that has permission to use the...

K13605: FirePass sudo vulnerability - CVE-2012-2053

Security Advisory Description Description F5 has identified a possible sudo vulnerability for FirePass. FirePass does not require a password to execute sudo commands with elevated permissions. FirePass is designed to function as a closed-box appliance with no user-level access to the underlying...

K53746212: Sudo vulnerability CVE-2019-14287

Security Advisory Description In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration...

K91327225: Linux sudo process vulnerability CVE-2019-18634

Security Advisory Description In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many othe...

K23151384: Sudo vulnerabilities CVE-2017-1000367 and CVE-2017-1000368

Security Advisory Description CVE-2017-1000367 Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation embedded spaces in the getprocessttyname function resulting in information disclosure and command execution. CVE-2017-1000368 Todd Miller's sudo version 1.8.20p1 and...

K04884013: NGINX Controller vulnerability CVE-2021-23019

Security Advisory Description The NGINX Controller Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package. CVE-2021-23019 Impact The Administrator password is exposed in the NGINX support package. This password leak occurs only when you enabled...

K49229034: Sudo vulnerabilities CVE-2014-9680, CVE-2016-7032, CVE-2016-7076, and CVE-2016-7077

Security Advisory Description CVE-2014-9680 sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access but not view file contents by running a program within an sudo session, as...

Important: Red Hat Security Advisory: Red Hat Virtualization Host 4.4.z SP 1 security update batch#4 (oVirt-4.5.3-4)

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. An update for redhat-release-virtualization-host, redhat-virtualization-host, and redhat-virtualization-host-productimg is now available fo...

sudo: arbitrary file write with privileges of the RunAs user

A vulnerability was found in sudo. Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user usually root. The prerequisite for exploitation is that the current user must be authorized by the sudoers policy to edit a fil...

RHEL 8 : Red Hat Virtualization Host 4.4.z SP 1 security update batch#4 (oVirt-4.5.3-4) (Important) (RHSA-2023:0859)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0859 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

K000132667: Sudo vulnerability CVE-2023-22809

Security Advisory Description In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user-provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to...

CVE-2022-45153

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created...

CVE-2022-45153

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created...