| CVE-2026-35535 |
BDSA-2026-6521 |
High |
Apr 03, 2026 |
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a
more...
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
less...
|
1.9.17, 1.9.14, 1.9.11, 1.9.5, 1.9.4, 1.9.3, 1.9.2, 1.9.0, 1.8.31, 1.8.30
|
| CVE-2025-32463 |
BDSA-2025-5776 |
High |
Jun 30, 2025 |
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot opt
more...
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
less...
|
1.9.17, 1.9.14
|
| CVE-2025-32462 |
BDSA-2025-5777 |
High |
Jun 30, 2025 |
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute comm
more...
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
less...
|
1.9.17, 1.9.14, 1.9.11, 1.9.5, 1.9.4, 1.9.3, 1.9.2, 1.9.0, 1.8.31, 1.8.30
|
| BDSA-2026-35494 |
|
Medium |
Sep 28, 2026 |
sudo is vulnerable to a protection mechanism failure due to missing handling of the `execveat(2)` syscall in its ptrace-based intercept mode. A local,
more...
sudo is vulnerable to a protection mechanism failure due to missing handling of the `execveat(2)` syscall in its ptrace-based intercept mode. A local, authenticated attacker with sudoers authorization can call `execveat(2)` directly, or indirectly through `fexecve(3)`, to run programs that the sudoers policy explicitly denies. No user interaction is required. Successful exploitation bypasses both policy enforcement and audit logging, giving the attacker full control over which programs execute under the elevated context, with full impact to confidentiality, integrity, and availability.
less...
|
|
| BDSA-2026-35053 |
|
Medium |
Sep 25, 2026 |
sudo is vulnerable to incorrect authorization due to improper handling of the TZ environment variable during evaluation of time-based sudoers rules. Wh
more...
sudo is vulnerable to incorrect authorization due to improper handling of the TZ environment variable during evaluation of time-based sudoers rules. When a sudoers entry uses NOTBEFORE or NOTAFTER to restrict when a command may be run, sudo inherits the TZ variable from the calling user's environment and passes it to mktime() without sanitization. A local, unprivileged attacker who already holds a time-restricted sudoers entry can set TZ to an extreme timezone offset before invoking sudo, shifting the apparent system time and causing sudo to permit command execution outside the intended authorization window. Because sudo runs setuid-root, the manipulated TZ value affects the privilege-elevated process directly. The resulting impact depends entirely on what the sudoers rule grants, but could allow the attacker to read sensitive files, modify system state, or execute arbitrary commands as root.
less...
|
|
| BDSA-2025-124009 |
|
Low |
Mar 13, 2026 |
Sudo is vulnerable to privilege escalation due to incorrect return code checks when dropping privileges to run the mailer. This could allow an attacker
more...
Sudo is vulnerable to privilege escalation due to incorrect return code checks when dropping privileges to run the mailer. This could allow an attacker to escalate privileges locally.
less...
|
|
