CVE-2014-0106
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2014-0106
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2014-0106.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2014-0106
- Related
- Published
- 2014-03-11T19:37:03Z
- Modified
- 2024-06-30T12:01:22Z
- Summary
- [none]
- Details
-
Sudo 1.6.9 before 1.8.5, when envreset is disabled, does not properly check environment variables for the envdelete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.
- References
-
- http://rhn.redhat.com/errata/RHSA-2014-0266.html
- http://www.sudo.ws/sudo/alerts/env_add.html
- http://www.ubuntu.com/usn/USN-2146-1
- https://support.apple.com/kb/HT205031
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00003.html
- http://www.openwall.com/lists/oss-security/2014/03/06/2
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/65997
- https://security-tracker.debian.org/tracker/CVE-2014-0106
Affected packages
Debian:11 / sudo
Package
- Name
- sudo
- Purl
- pkg:deb/debian/sudo?arch=source
Debian:12 / sudo
Package
- Name
- sudo
- Purl
- pkg:deb/debian/sudo?arch=source
Debian:13 / sudo
Package
- Name
- sudo
- Purl
- pkg:deb/debian/sudo?arch=source