TM
Vendor
Todd Miller
29
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-7032 | SU Sudo Todd Miller | 7.0 | Apr 14 | sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application that calls the (1) system or (2) popen… |
| CVE-2014-0106 | SU Sudo Todd Miller | – | Mar 11 | Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions… |
| CVE-2013-2777 | SU Sudo Todd Miller | – | Apr 8 | sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with… |
| CVE-2013-2776 | SU Sudo Todd Miller | – | Apr 8 | sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate… |
| CVE-2013-1776 | SU Sudo Todd Miller | – | Apr 8 | sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users… |
| CVE-2013-1775 | SU Sudo Todd Miller | – | Mar 5 | sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without… |
| CVE-2012-3440 | SU Sudo Todd Miller | – | Aug 8 | A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak… |
| CVE-2012-2337 | SU Sudo Todd Miller | – | May 18 | sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended… |
| CVE-2012-0809 | SU Sudo Todd Miller | – | Feb 1 | Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name… |
| CVE-2011-0008 | SU Sudo Todd Miller | – | Jan 20 | A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization… |
| CVE-2011-0010 | SU Sudo Todd Miller | – | Jan 18 | check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which… |
| CVE-2010-2956 | SU Sudo Todd Miller | – | Sep 10 | Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain… |
| CVE-2010-1646 | SU Sudo Todd Miller | – | Jun 7 | The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which… |
| CVE-2010-1163 | SU Sudo Todd Miller | – | Apr 16 | The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the… |
| CVE-2010-0427 | SU Sudo Todd Miller | – | Feb 25 | sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command |
| CVE-2010-0426 | SU Sudo Todd Miller | – | Feb 24 | sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in… |
| CVE-2007-4305 | SU Sudo Todd Miller | – | Aug 13 | Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and… |
| CVE-2007-3149 | SU Sudo Todd Miller | – | Jun 11 | sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a… |
| CVE-2006-0151 | SU Sudo Todd Miller | – | Jan 9 | sudo 1.6.8 and other versions does not clear the PYTHONINSPECT environment variable, which allows limited local users to gain privileges via a Python script, a variant of… |
| CVE-2005-4158 | SU Sudo Todd Miller | – | Dec 11 | Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which allows limited local users to… |
| CVE-2005-2959 | SU Sudo Todd Miller | – | Oct 25 | Incomplete blacklist vulnerability in sudo 1.6.8 and earlier allows local users to gain privileges via the (1) SHELLOPTS and (2) PS4 environment variables before executing a bash… |
| CVE-2005-1993 | SU Sudo Todd Miller | – | Jun 20 | Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users to gain privileges via a symlink attack |
| CVE-2005-1831 | SU Sudo Todd Miller | 8.4 | May 31 | Sudo 1.6.8p7 on SuSE Linux 9.3, and possibly other Linux distributions, allows local users to gain privileges by using sudo to call su, then entering a blank password and hitting… |
| CVE-2005-1119 | SU Sudo Todd Miller | – | May 2 | Sudo VISudo 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files |
| CVE-2004-1051 | SU Sudo Todd Miller | – | Mar 1 | sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within… |
| CVE-2004-1689 | SU Sudo Todd Miller | – | Sep 16 | sudoedit (aka sudo -e) in sudo 1.6.8 opens a temporary file with root privileges, which allows local users to read arbitrary files via a symlink attack on the temporary file… |
| CVE-2002-0043 | SU Sudo Todd Miller | – | Jan 31 | sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment… |
| CVE-1999-1496 | SU Sudo Todd Miller | – | Jun 8 | Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a program, which… |
| CVE-1999-0958 | SU Sudo Todd Miller | – | Jan 12 | sudo 1.5.x allows local users to execute arbitrary commands via a |