Описание
ELSA-2020-0726: sudo security update (IMPORTANT)
[1.8.6p3-29.0.1.el6_10.3]
- Fixes [OraBug: 28747380] sudo does not honor env_keep-='KRB5CCNAME' after 'sudo -k' (isaac.chen@oracle.com)
[1.8.6p3-29.3]
- RHEL-6.10.z ERRATUM
- fixed CVE-2019-18634 Resolves: rhbz#1799018
[1.8.6p3-29.2]
- RHEL-6.10.z ERRATUM
- fixed CVE-2019-14287 Resolves: rhbz#1760684
Обновленные пакеты
Oracle Linux 6
Oracle Linux x86_64
sudo
1.8.6p3-29.0.1.el6_10.3
sudo-devel
1.8.6p3-29.0.1.el6_10.3
Oracle Linux i686
sudo
1.8.6p3-29.0.1.el6_10.3
sudo-devel
1.8.6p3-29.0.1.el6_10.3
Связанные CVE
Связанные уязвимости
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users ...
