SUSE-SU-2016:2891-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2016:2891-1

Related

Published

2016-11-23T14:34:44Z

Modified

2016-11-23T14:34:44Z

Summary

Security update for sudo

Details

This update for sudo fixes the following issues:

Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
- noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
- noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]
The SSSD plugin would occasionally crash sudo with an 'internal error'. This issue has been fixed. [bsc#948973]
The SSSD plugin would occasionally apply @netgroups rules from LDAP to all users rather than the @netgroup. This issue is now fixed. [bsc#966755]
When the SSSD plugin was used and a local user ran sudo, an e-mail used to be sent to administrator because SSSD did not support sudo rules for local users. This message did not signify an error, however, it was only noise. [bsc#1008043]

References

Affected packages

Name: sudo
Purl: purl:rpm/suse/sudo&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7.6p2-0.29.1

{
    "binaries": [
        {
            "sudo": "1.7.6p2-0.29.1"
        }
    ]
}

Name: sudo
Purl: purl:rpm/suse/sudo&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7.6p2-0.29.1

{
    "binaries": [
        {
            "sudo": "1.7.6p2-0.29.1"
        }
    ]
}