Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2014-9680 →

DEBIAN-CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary fil...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 sudo

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12-1"}]}]

Debian:13 sudo

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12-1"}]}]

Debian:14 sudo

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.12-1"}]}]

Références

advisory security-tracker.debian.org