GCVE - cpe:2.3:a:todd_miller:sudo:1.6.3

Approved changes feed: RSS · Atom

cpe:2.3:a:todd_miller:sudo:1.6.3_p2:*:*:*:*:*:*:*

part: a version: 1.6.3_p2 update: *

Vendor	Todd Miller (`6e64c61d-ae67-5a3c-a0c7-5a9c304d6f92`)
Product	Sudo (`ffec71ae-72fb-5429-b6f7-5160d870c451`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/millert/sudo`	purl2cpe	2026-06-01 10:15:50.075698
`pkg:deb/debian/sudo`	purl2cpe	2026-06-01 10:15:50.075700
`pkg:deb/ubuntu/sudo`	purl2cpe	2026-06-01 10:15:50.075702
`pkg:github/millert/sudo`	purl2cpe	2026-06-01 10:15:50.075703
`pkg:github/sudo-project/sudo`	purl2cpe	2026-06-01 10:15:50.075705
`pkg:gitlab/redhat/sudo`	purl2cpe	2026-06-01 10:15:50.075707
`pkg:rpm/fedora/sudo`	purl2cpe	2026-06-01 10:15:50.075708
`pkg:rpm/opensuse/sudo`	purl2cpe	2026-06-01 10:15:50.075710

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-0008`	vulnerable	2026-06-08 04:56:32.984815	Details available A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression. Published: 2011-01-20T18:00:00.000Z Updated: 2024-08-06T21:36:02.454Z Open on db.gcve.eu Reference links http://www.mandriva.com/security/advisories?name=MDVSA-2011:018 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053263.html http://www.vupen.com/english/advisories/2011/0199 https://bugzilla.redhat.com/show_bug.cgi?id=668843 https://exchange.xforce.ibmcloud.com/vulnerabilities/64965	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0427`	vulnerable	2026-06-08 04:52:02.490662	Details available sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command. Published: 2010-02-25T19:00:00.000Z Updated: 2024-08-07T00:45:12.240Z Open on db.gcve.eu Reference links http://secunia.com/advisories/38803 ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz http://www.gentoo.org/security/en/glsa/glsa-201003-01.xml http://sudo.ws/repos/sudo/rev/aa0b6c01c462 http://secunia.com/advisories/38762	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0426`	vulnerable	2026-06-08 04:52:02.472035	Details available sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory. Published: 2010-02-24T18:00:00.000Z Updated: 2024-08-07T00:45:12.329Z Open on db.gcve.eu Reference links http://secunia.com/advisories/38803 ftp://ftp.sudo.ws/pub/sudo/sudo-1.6.9p21.patch.gz http://sudo.ws/repos/sudo/rev/88f3181692fe https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7238 http://www.gentoo.org/security/en/glsa/glsa-201003-01.xml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4305`	vulnerable	2026-06-08 04:49:56.063064	Details available Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and consequently bypass access control policy and auditing. Published: 2007-08-13T21:00:00.000Z Updated: 2024-08-07T14:53:55.846Z Open on db.gcve.eu Reference links http://secunia.com/advisories/26479 http://www.watson.org/~robert/2007woot/ http://www.securityfocus.com/bid/25258	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0151`	vulnerable	2026-06-08 04:48:46.053753	Details available sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of CVE-2005-4158. Published: 2006-01-09T23:00:00.000Z Updated: 2024-08-07T16:25:33.651Z Open on db.gcve.eu Reference links http://www.trustix.org/errata/2006/0010 http://secunia.com/advisories/18549 http://secunia.com/advisories/18558 http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.421822 http://secunia.com/advisories/18363	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4158`	vulnerable	2026-06-08 04:48:43.112565	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-2959`	vulnerable	2026-06-08 04:48:30.966601	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-1993`	vulnerable	2026-06-08 04:48:28.034115	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-1119`	vulnerable	2026-06-08 04:48:25.503032	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-1051`	vulnerable	2026-06-08 04:47:52.597940	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2002-0043`	vulnerable	2026-06-08 04:46:20.475238	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Sudo

Notes

PURL mappings

Vulnerability references

Contribute