Todd Miller maintains sudo, a foundational Unix privilege-escalation utility that sits in the trusted execution path on countless systems spanning servers, workstations, and embedded platforms. Despite a narrow product scope, sudo's prominence in the system administration layer and its role as a gatekeeper for privilege transitions drive significant attention to its security posture. Vulnerabilities affecting sudo frequently acquire public exploit code and recur through weakness classes including improper input validation, access-control logic flaws, insecure link resolution, and format-string handling—issues that directly threaten the integrity of privilege boundaries. The utility's ubiquity and deep integration into authentication and authorization workflows make even modest flaws consequential for defenders; live severity, exploitation activity, and remediation guidance are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Todd Miller over time
Signals from CVEs in this vendor scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-1775MEDIUM sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without r | Mar 5, 2013 | 6.9 | 43 | NO | YES |
CVE-2012-0809HIGH Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name fo | Feb 1, 2012 | 7.2 | 35 | NO | YES |
CVE-2002-0043HIGH sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment v | Jan 31, 2002 | 7.2 | 33 | NO | YES |
CVE-2012-2337HIGH sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended comma | May 18, 2012 | 7.2 | 25 | NO | NO |
CVE-2007-4305MEDIUM Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and conseque | Aug 13, 2007 | 6.2 | 25 | NO | YES |
CVE-2010-0426MEDIUM sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in | Feb 24, 2010 | 6.9 | 24 | NO | NO |
CVE-2010-1646MEDIUM The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might | Jun 7, 2010 | 6.2 | 22 | NO | NO |
CVE-2004-1051HIGH sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the | Mar 1, 2005 | 7.2 | 22 | NO | NO |
CVE-2014-0106MEDIUM Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to | Mar 11, 2014 | 6.6 | 21 | NO | NO |
CVE-2011-0008MEDIUM A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decis | Jan 20, 2011 | 6.9 | 21 | NO | NO |
Signals from CVEs in this vendor scope (29 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Todd Miller.
Media articles that mention a CVE ID that affects a product developed by Todd Miller — matched by CVE ID, not by vendor name.