Red Hat Security AdvisoryRHSA-2016:2872
sudo security update
Released 2016-12-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) sudo-1.8.6p7-21.el7_3
- Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3
- Red Hat Enterprise Linux ComputeNode (v. 7) sudo-1.8.6p7-21.el7_3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3
- Red Hat Enterprise Linux Desktop (v. 6) sudo-1.8.6p3-25.el6_8
- Red Hat Enterprise Linux Desktop Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8
- Red Hat Enterprise Linux HPC Node (v. 6) sudo-1.8.6p3-25.el6_8
- Red Hat Enterprise Linux HPC Node Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8
- Red Hat Enterprise Linux Server (v. 6) sudo-1.8.6p3-25.el6_8
- Red Hat Enterprise Linux Server (v. 7) sudo-1.8.6p7-21.el7_3
- Red Hat Enterprise Linux Server Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8, sudo-devel-1.8.6p3-25.el6_8.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3, sudo-devel-1.8.6p7-21.el7_3.ppc
- Red Hat Enterprise Linux Workstation (v. 6) sudo-1.8.6p3-25.el6_8
- Red Hat Enterprise Linux Workstation (v. 7) sudo-1.8.6p7-21.el7_3
- Red Hat Enterprise Linux Workstation Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8
- Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3
Fixes 2 records
Priority LOW 34
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00467 · Published 2018-05-29 · Partial fix CWE-184
Priority LOW 31
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.
CVSS 3.0HIGH 7.0· Local · Low privileges · No interaction · EPSS 0.00337 · Published 2017-04-14 · Partial fix CWE-284
