GCVE - cpe:2.3:a:todd_miller:sudo:1.7.4p5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:todd_miller:sudo:1.7.4p5:*:*:*:*:*:*:*

part: a version: 1.7.4p5 update: *

Vendor	Todd Miller (`6e64c61d-ae67-5a3c-a0c7-5a9c304d6f92`)
Product	Sudo (`ffec71ae-72fb-5429-b6f7-5160d870c451`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/millert/sudo`	purl2cpe	2026-06-01 10:15:50.287516
`pkg:deb/debian/sudo`	purl2cpe	2026-06-01 10:15:50.287518
`pkg:deb/ubuntu/sudo`	purl2cpe	2026-06-01 10:15:50.287519
`pkg:github/millert/sudo`	purl2cpe	2026-06-01 10:15:50.287521
`pkg:github/sudo-project/sudo`	purl2cpe	2026-06-01 10:15:50.287522
`pkg:gitlab/redhat/sudo`	purl2cpe	2026-06-01 10:15:50.287524
`pkg:rpm/fedora/sudo`	purl2cpe	2026-06-01 10:15:50.287525
`pkg:rpm/opensuse/sudo`	purl2cpe	2026-06-01 10:15:50.287526

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-0106`	vulnerable	2026-06-08 05:05:11.495758	Details available Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable. Published: 2014-03-11T15:00:00.000Z Updated: 2024-08-06T09:05:38.667Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.sudo.ws/sudo/alerts/env_add.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00003.html http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html http://www.ubuntu.com/usn/USN-2146-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2777`	vulnerable	2026-06-08 05:04:27.879989	Details available sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions. Published: 2013-04-08T17:00:00.000Z Updated: 2024-08-06T15:44:33.678Z Open on db.gcve.eu Reference links http://www.sudo.ws/repos/sudo/rev/bfa23f089bba http://www.securityfocus.com/bid/58207 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839 http://www.sudo.ws/repos/sudo/rev/2f3225a2a4a4 http://rhn.redhat.com/errata/RHSA-2013-1701.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2776`	vulnerable	2026-06-08 05:04:27.857046	Details available sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions. Published: 2013-04-08T17:00:00.000Z Updated: 2024-08-06T15:44:33.684Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.sudo.ws/repos/sudo/rev/049a12a5cc14 http://www.securityfocus.com/bid/58207 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839 http://rhn.redhat.com/errata/RHSA-2013-1701.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1776`	vulnerable	2026-06-08 05:03:56.336146	Details available sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions. Published: 2013-04-08T17:00:00.000Z Updated: 2024-08-06T15:13:33.004Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/58207 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839 http://www.debian.org/security/2013/dsa-2642 http://www.sudo.ws/repos/sudo/rev/6b22be4d09f0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1775`	vulnerable	2026-06-08 05:03:56.322809	Details available sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch. Published: 2013-03-04T21:00:00.000Z Updated: 2024-08-06T15:13:32.822Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/58203 http://www.sudo.ws/repos/sudo/rev/ddf399e3e306 http://www.sudo.ws/sudo/alerts/epoch_ticket.html http://osvdb.org/90677	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Todd Miller Sudo 1.7.4p5

Notes

PURL mappings

Vulnerability references

Contribute