Sudo
Vendor:
First CVE: Jan 12, 1998 · Active for 28 years
29
Total CVEs
More Total CVEs than 96% of tracked products
2.2
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
5.7
Avg CVSS
Higher Avg CVSS than 17% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Sudo over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 12, 1998
28 years ago
Most Recent CVE
Apr 14, 2017
3,388 days ago
CVE Severity & Scoring
Sudo29 CVEs
14%
55%
31%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local2 (6.9%)
Network0 (0.0%)
Unknown27 (93.1%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low1 (3.4%)
High1 (3.4%)
Unknown27 (93.1%)
User Interaction
None2 (6.9%)
Unknown27 (93.1%)
Required0 (0.0%)
Privileges Required
Low1 (3.4%)
High0 (0.0%)
None1 (3.4%)
Unknown27 (93.1%)
Top CVEs
Signals from CVEs in this product scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-1775MEDIUM sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without r | Mar 5, 2013 | 6.9 | 43 | NO | YES |
CVE-2012-0809HIGH Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name fo | Feb 1, 2012 | 7.2 | 35 | NO | YES |
CVE-2002-0043HIGH sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment v | Jan 31, 2002 | 7.2 | 33 | NO | YES |
CVE-2012-2337HIGH sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended comma | May 18, 2012 | 7.2 | 25 | NO | NO |
CVE-2007-4305MEDIUM Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and conseque | Aug 13, 2007 | 6.2 | 25 | NO | YES |
CVE-2010-0426MEDIUM sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in | Feb 24, 2010 | 6.9 | 24 | NO | NO |
CVE-2010-1646MEDIUM The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might | Jun 7, 2010 | 6.2 | 22 | NO | NO |
CVE-2004-1051HIGH sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables to create functions that have the same name as any program within the | Mar 1, 2005 | 7.2 | 22 | NO | NO |
CVE-2014-0106MEDIUM Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to | Mar 11, 2014 | 6.6 | 21 | NO | NO |
CVE-2011-0008MEDIUM A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decis | Jan 20, 2011 | 6.9 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (29 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
3.4% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
6 CVEs
20.7% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (29 CVEs).
Media Mentions
Signals from CVEs in this product scope (29 CVEs).
Top CNAs Publishing CVEs For Sudo
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.8.9 | 1 | 7.0 | 0.3% | 0 | 0 |
| 1.8.8 | 1 | 7.0 | 0.3% | 0 | 0 |
| 1.8.7 | 1 | 7.0 | 0.3% | 0 | 0 |
| 1.8.6p6 | 1 | 6.9 | 3.2% | 0 | 1 |
| 1.8.6p5 | 2 | 5.7 | 1.8% | 0 | 1 |
| 1.8.6p4 | 2 | 5.7 | 1.8% | 0 | 1 |
| 1.8.6p3 | 2 | 5.7 | 1.8% | 0 | 1 |
| 1.8.6p2 | 2 | 5.7 | 1.8% | 0 | 1 |
| 1.8.6p1 | 2 | 5.7 | 1.8% | 0 | 1 |
| 1.8.6 | 3 | 6.1 | 1.3% | 0 | 1 |
| 1.8.5p3 | 1 | 6.9 | 3.2% | 0 | 1 |
| 1.8.5p2 | 1 | 6.9 | 3.2% | 0 | 1 |
| 1.8.5p1 | 1 | 6.9 | 3.2% | 0 | 1 |
| 1.8.5 | 5 | 5.4 | 0.9% | 0 | 1 |
| 1.8.4p5 | 5 | 5.3 | 0.9% | 0 | 1 |
| 1.8.4p4 | 5 | 5.3 | 0.9% | 0 | 1 |
| 1.8.4p3 | 5 | 5.3 | 0.9% | 0 | 1 |
| 1.8.4p2 | 5 | 5.3 | 0.9% | 0 | 1 |
| 1.8.4p1 | 5 | 5.3 | 0.9% | 0 | 1 |
| 1.8.4 | 6 | 5.6 | 0.8% | 0 | 1 |