rpm package
opensuse/sudo&distro=openSUSE Leap 15.2
pkg:rpm/opensuse/sudo&distro=openSUSE%20Leap%2015.2
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-3156 | — | KEV | < 1.8.22-lp152.8.6.1 | 1.8.22-lp152.8.6.1 | Jan 26, 2021 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | |
| CVE-2021-23240 | — | < 1.8.22-lp152.8.6.1 | 1.8.22-lp152.8.6.1 | Jan 12, 2021 | selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines witho | ||
| CVE-2021-23239 | — | < 1.8.22-lp152.8.6.1 | 1.8.22-lp152.8.6.1 | Jan 12, 2021 | The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path. |
- affected < 1.8.22-lp152.8.6.1fixed 1.8.22-lp152.8.6.1
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- CVE-2021-23240Jan 12, 2021affected < 1.8.22-lp152.8.6.1fixed 1.8.22-lp152.8.6.1
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines witho
- CVE-2021-23239Jan 12, 2021affected < 1.8.22-lp152.8.6.1fixed 1.8.22-lp152.8.6.1
The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning a sudo_edit.c race condition in replacing a user-controlled directory by a symlink to an arbitrary path.