parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade sudo | Jul 30, 2024 | Jan 30, 2009 |
| Freebsd | — | Upgrade sudo | Dec 10, 2025 | Feb 6, 2009 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Oct 30, 2017 | Jan 30, 2009 |
| Oracle_linux | — | Upgrade sudo | Oct 16, 2024 | Jan 30, 2009 |
| Suse | — | Upgrade sudo | Feb 17, 2015 | Jan 30, 2009 |
| Ubuntu | — | Upgrade sudo | Nov 8, 2024 | Jan 30, 2009 |
| Vmsa 2009 0009 Service Console Package Sudo | — | Upgrade VMware ESX 4.0 to build number 175625 | Sep 2, 2010 | Jan 30, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub