Threat database

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

CVE-2023-42465 is a vulnerability in sudo versions prior to 1.9.15 that may allow row hammer attacks leading to authentication bypass or privilege escalation. The issue arises because the application logic relies on checking for non-equality to an error value rather than equality to a success value, combined with values that are susceptible to single-bit flips. This flaw was fixed in sudo version 1.9.15.