Read the docs
TI-2016-06043 Aliases CVE-2016-7032GHSA-wmxc-c63f-gpf8

sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended…

Priority LOW 31CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 16 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen function.

Why it matters now

EPSS 0.00337 27th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 16 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:a:todd_miller:sudo:1.6.8:*:*:*:*:*:*:*1.6.8VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.6.9:*:*:*:*:*:*:*1.6.9VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableTodd Miller
  • cpe:2.3:a:todd_miller:sudo:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Todd Miller
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:todd_miller:sudo:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.9:*:*:*:*:*:*:*1.7.9VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.7.10:*:*:*:*:*:*:*1.7.10VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.4:*:*:*:*:*:*:*1.8.4VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.5:*:*:*:*:*:*:*1.8.5VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.6:*:*:*:*:*:*:*1.8.6VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.7:*:*:*:*:*:*:*1.8.7VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.8:*:*:*:*:*:*:*1.8.8VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.9:*:*:*:*:*:*:*1.8.9VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.10:*:*:*:*:*:*:*1.8.10VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.11:*:*:*:*:*:*:*1.8.11VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.12:*:*:*:*:*:*:*1.8.12VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.13:*:*:*:*:*:*:*1.8.13VulnerableTodd Miller
cpe:2.3:a:todd_miller:sudo:1.8.14:p3:*:*:*:*:*:*1.8.14 p3VulnerableTodd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.8:*:*:*:*:*:*:* Versions 1.7.8 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.9:*:*:*:*:*:*:* Versions 1.7.9 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.7.10:*:*:*:*:*:*:* Versions 1.7.10 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.6:*:*:*:*:*:*:* Versions 1.8.6 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.8:*:*:*:*:*:*:* Versions 1.8.8 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.9:*:*:*:*:*:*:* Versions 1.8.9 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.10:*:*:*:*:*:*:* Versions 1.8.10 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.11:*:*:*:*:*:*:* Versions 1.8.11 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.12:*:*:*:*:*:*:* Versions 1.8.12 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.13:*:*:*:*:*:*:* Versions 1.8.13 Vulnerable ·Todd Miller
  • cpe:2.3:a:todd_miller:sudo:1.8.14:p3:*:*:*:*:*:* Versions 1.8.14 p3 Vulnerable ·Todd Miller

Remediation

Red Hat 1 advisory

  • RHSA-2016:2872 Released 2016-12-06 · Red Hat rating Moderate
    sudo security update
    • Red Hat Enterprise Linux Client (v. 7) sudo-1.8.6p7-21.el7_3
    • Red Hat Enterprise Linux Client Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3
    • Red Hat Enterprise Linux ComputeNode (v. 7) sudo-1.8.6p7-21.el7_3
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3
    • Red Hat Enterprise Linux Desktop (v. 6) sudo-1.8.6p3-25.el6_8
    • Red Hat Enterprise Linux Desktop Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8
    • Red Hat Enterprise Linux HPC Node (v. 6) sudo-1.8.6p3-25.el6_8
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8
    • Red Hat Enterprise Linux Server (v. 6) sudo-1.8.6p3-25.el6_8
    • Red Hat Enterprise Linux Server (v. 7) sudo-1.8.6p7-21.el7_3
    • Red Hat Enterprise Linux Server Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8, sudo-devel-1.8.6p3-25.el6_8.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3, sudo-devel-1.8.6p7-21.el7_3.ppc
    • Red Hat Enterprise Linux Workstation (v. 6) sudo-1.8.6p3-25.el6_8
    • Red Hat Enterprise Linux Workstation (v. 7) sudo-1.8.6p7-21.el7_3
    • Red Hat Enterprise Linux Workstation Optional (v. 6) sudo-devel-1.8.6p3-25.el6_8
    • Red Hat Enterprise Linux Workstation Optional (v. 7) sudo-devel-1.8.6p7-21.el7_3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2016:2872
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2016:2872
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2016:2872
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2016:2872

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-7032
  2. 2026-10-03 Alias added: GHSA-wmxc-c63f-gpf8

References

Advisory 3

Other 1

  • TI-2005-01738 Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local… CVSS 3.1HIGH 8.4
  • TI-2012-00746 Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1… CVSS 2.0HIGH 7.2
  • TI-2013-01562 sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or… CVSS 2.0MEDIUM 6.9
  • TI-2004-00948 sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style… CVSS 2.0HIGH 7.2
  • TI-2010-00404 sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled… CVSS 2.0MEDIUM 6.9
  • TI-2006-00144 sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable… CVSS 2.0HIGH 7.2
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences