CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

Affected products

Alt Linux, Centos, Red Hat, Suse, Ubuntu, Sudo

Sudo Project Sudo

≤ 1.8.11

Fix

Available

CVSS 3.0

3.3 LOW

EPSS

0.5% (39th percentile)

Weakness

CWE-200

NVD status

Modified

Published

2017-04-24

No exploit for CVE-2014-9680 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.