MGASA-2016-0389
- Source
- https://advisories.mageia.org/MGASA-2016-0389.html
- Import Source
- https://advisories.mageia.org/MGASA-2016-0389.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2016-0389
- Related
- Published
- 2016-11-17T23:40:52Z
- Modified
- 2016-11-17T23:30:58Z
- Summary
- Updated sudo packages fix security vulnerability
- Details
-
It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges (CVE-2016-7076).
- References
-
- https://advisories.mageia.org/MGASA-2016-0389.html
- https://bugs.mageia.org/show_bug.cgi?id=19762
- https://www.sudo.ws/alerts/noexec_wordexp.html
- https://www.sudo.ws/stable.html#1.8.18p1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DBELDP5KT7URCP7P3RQFYBBKPBNLAJY6/
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:5 / sudo
Package
- Name
- sudo
- Purl
- pkg:rpm/mageia/sudo?distro=mageia-5