CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is
associated with a zoneinfo file, which allows local users to open arbitrary
files for read access (but not view file contents) by running a program
within an sudo session, as demonstrated by interfering with terminal
output, discarding kernel-log messages, or repositioning tape drives.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=772707&gt;