- February 27, 2013
A potential security issue exists that may allow a user to bypass authentication if they are able to reset the system clock. Affected sudo versions are 1.6.0 through 1.7.10p7 and sudo 1.8.0 through 1.8.6p7.
- February 27, 2013
A potential security issue exists that may allow a user to bypass the tty_tickets constraints. Affected sudo versions are 1.3.5 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p7 when the "tty_tickets" option is enabled.
- May 16, 2012
A potential security issue exists in the matching of hosts against an IPv4 network specified in sudoers. Affected sudo versions are 1.6.9p3 through 1.8.4p4. The flaw may allow a user who is authorized to run commands on hosts belonging to one IPv4 network to run commands on a different host.
- January 30, 2012
A format string vulnerability has been found when the -D (debugging) flag is used. Affected sudo versions are 1.8.0 through 1.8.3p1. The flaw may allow a user to run commands as root without being prompted for a password.
- January 12, 2011
A potential security issue exists in the handling of sudo's -g command line option when -u is not specified. Affected sudo versions are 1.7.0 through 1.7.4p4. The flaw may allow a user to run commands as a group without being prompted for a password.
- September 7, 2010
A potential security issue exists in the handling of sudo's -g command line option when -u is also specified. Affected sudo versions are 1.7.0 through 1.7.4p3. The flaw may allow an attacker to run commands as a user that is not authorized by the sudoers file.
- June 2, 2010
A potential security issue exists in sudo's secure path functionality in sudo versions 1.3.1 through 1.6.9p22 and versions 1.7.0 through 1.7.2p6. The flaw may allow an attacker to bypass the secure path PATH restrictions and set PATH to a user-controlled value.
- April 9, 2010
An additional security issue exists in sudo's -e option (aka sudoedit) in sudo versions 1.6.8 through 1.7.2p5 that may give a user with permission to run sudoedit the ability to run arbitrary commands.
- February 22, 2010
A security issue exists in sudo's -e option (aka sudoedit) in sudo versions 1.6.9 through 1.7.2p3 that may give a user with permission to run sudoedit the ability to run arbitrary commands.
- December 6, 2009
A security issue with sudoers rules that include Cmnd_Alias entries that use the negation operator has been fixed.
- January 29, 2009
A security issue with sudoers rules that include a group in the RunAs portion of the rule has been discovered.
- July 17, 2007
A security issue has been discovered with the Kerberos 5 authentication that allows a malicious user to avoid authenticating with sudo.
- November 8, 2005
A security issue has been discovered that allows a malicious user with permission to run a perl shell script to execute arbitrary perl code.
- October 27, 2005
A security issue has been discovered that allows a malicious user with permission to run a bash shell script to execute arbitrary commands.
- June 20, 2005
A race condition has been discovered that could allow a malicious user with sudo privileges to execute arbitrary commands.
- November 11, 2004
A security issue has been discovered that allows a malicious user with permission to run a bash shell script to execute arbitrary commands.
- September 15, 2004
A bug in sudoedit has been discovered that allows a malicious user to read files that would otherwise be unreadable.
- April 25, 2002
A buffer overflow bug has been discovered in sudo's prompt expansion code.
- Jan 14, 2002
A security issue that could allow an attacker to to gain root privileges via sudo if the Postfix mailer is installed has been discovered.
- Feb 22, 2001
A heap corruption bug has been discovered in sudo's logging functions.