CVE-2025-32463

>= 1.9.14 and < 1.9.17

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used

9.3CRITICAL

CVE-2025-32462

< 1.9.17

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed

2.8LOW

CVE-2025-46718

< 0.2.6

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges

3.3LOW

CVE-2025-46717

< 0.2.6

sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) su

3.3LOW

CVE-2023-7090

< 1.8.28

A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo.

6.6MEDIUM

CVE-2023-42465

< 1.9.15

Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic so

7.0HIGH

CVE-2023-42456

< 0.2.1

Sudo-rs, a memory safe implementation of sudo and su, allows users to not have to enter authentication at every sudo attempt, but

3.1LOW

CVE-2023-28487

< 1.9.13

Sudo before 1.9.13 does not escape control characters in sudoreplay output.

5.3MEDIUM

CVE-2023-28486

< 1.9.13

Sudo before 1.9.13 does not escape control characters in log messages.

5.3MEDIUM

CVE-2023-27320

>= 1.9.8 and < 1.9.13

Sudo before 1.9.13p2 has a double free in the per-command chroot feature.

7.2HIGH

CVE-2023-22809

>= 1.8.0 and < 1.9.12

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variable

7.8HIGH

CVE-2022-43995

>= 1.8.0 and < 1.9.12

Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error t

7.1HIGH

CVE-2021-3156

>= 1.8.2 and < 1.8.32

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalatio

7.8HIGH

CVE-2021-23240

< 1.8.32

selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate pri

7.8HIGH

CVE-2021-23239

< 1.8.32

The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests b

2.5LOW

CVE-2019-18634

>= 1.7.1 and < 1.8.26

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged

7.8HIGH

CVE-2019-19234

<= 1.8.29

In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a pass

7.5HIGH

CVE-2019-19232

<= 1.8.29

In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo

7.5HIGH

CVE-2005-4890

>= 1.3.0 and <= 1.7.4

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user sessio

7.8HIGH

CVE-2019-18684

<= 1.8.29

Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. Thi

7.0HIGH

CVE-2019-14287

< 1.8.28

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM

8.8HIGH

CVE-2016-7076

>= 1.6.8 and <= 1.8.18

sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp

6.4MEDIUM

CVE-2015-8239

all versions

The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the calle

7.0HIGH

CVE-2017-1000368

<= 1.8.20

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttynam

8.2HIGH

CVE-2017-1000367

<= 1.8.20

Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname()

6.4MEDIUM

CVE-2014-9680

<= 1.8.11

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users t

3.3LOW

CVE-2016-7032

all versions

sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an applic

7.0HIGH

CVE-2015-5602

<= 1.8.14

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined usi

CVE-2014-0106

all versions

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction,

CVE-2013-2777

<= 1.7.10p4

sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling

CVE-2013-2776

all versions

sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_t

CVE-2013-1776

all versions

sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controll

CVE-2013-1775

all versions

sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended

CVE-2012-3440

all versions

A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a

CVE-2012-2337

all versions

sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax,

CVE-2012-0809

all versions

Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code

CVE-2011-0008

<= 1.7.4p5

A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %gro

CVE-2011-0010

all versions

check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that inv

CVE-2010-2956

all versions

Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with th

CVE-2010-1646

all versions

The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment

CVE-2010-1163

all versions

The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working direc

CVE-2010-0427

all versions

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local use

CVE-2010-0426

all versions

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pse

CVE-2009-0034

all versions

parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during autho

7.8HIGH

CVE-2007-4305

all versions

Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users

CVE-2007-3149

all versions

sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which

CVE-2006-0151

all versions

sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain priv

CVE-2005-4158

all versions

Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment

CVE-2005-2959

all versions

Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) P

CVE-2005-1993

all versions

Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows loc

CVE-2005-1831

all versions

Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local users to gain privileges by using sudo to cal

8.4HIGH

CVE-2005-1119

all versions

Sudo VISudo 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.

CVE-2004-1051

all versions

sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions

CVE-2004-1689

all versions

sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files

CVE-2002-0184

< 1.6.6

Sudo before 1.6.6 contains an off-by-one error that can result in a heap-based buffer overflow that may allow local users to gain

7.8HIGH

CVE-2002-0043

all versions

sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users

CVE-1999-1496

all versions

Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to exe

CVE-1999-0958

all versions

sudo 1.5.x allows local users to execute arbitrary commands via a .. (dot dot) attack.