Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sudo | Aug 30, 2017 | Jan 31, 2012 |
| Debian | — | Upgrade sudo | Jul 30, 2024 | Feb 1, 2012 |
| Freebsd | — | Upgrade sudo | Dec 10, 2025 | Jan 30, 2012 |
| Gentoo Linux | — | Upgrade app-admin/sudo. | Oct 30, 2017 | Jan 31, 2012 |
| Suse | — | Upgrade sudo-debugsourceUpgrade sudoUpgrade sudo-debuginfoUpgrade sudo-devel | Dec 12, 2013 | Jan 31, 2012 |
| Ubuntu | — | Upgrade sudo | Nov 19, 2024 | Feb 1, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub