UbuntuUpdates.org

Package "sudo"

Name: sudo

Description:

Provide limited super user privileges to specific users

Latest version: 1.8.16-0ubuntu1.8
Release: xenial (16.04)
Level: updates
Repository: main
Homepage: http://www.sudo.ws/

Links

Save this URL for the latest version of "sudo": https://www.ubuntuupdates.org/sudo


Download "sudo"


Other versions of "sudo" in Xenial

Repository Area Version
base universe 1.8.16-0ubuntu1
base main 1.8.16-0ubuntu1
security universe 1.8.16-0ubuntu1.8
security main 1.8.16-0ubuntu1.8
updates universe 1.8.16-0ubuntu1.8

Changelog

Version: 1.8.16-0ubuntu1.8 2019-10-14 17:07:09 UTC

  sudo (1.8.16-0ubuntu1.8) xenial-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via UID -1
    - debian/patches/CVE-2019-14287.patch: treat an ID of -1 as invalid
      in lib/util/strtoid.c.
    - CVE-2019-14287
    - debian/patches/CVE-2019-14287-2.patch: fix and add to tests in
      lib/util/regress/atofoo/atofoo_test.c,
      plugins/sudoers/regress/testsudoers/test5.out.ok,
      plugins/sudoers/regress/testsudoers/test5.sh.
    - CVE-2019-14287

 -- Marc Deslauriers <email address hidden> Thu, 10 Oct 2019 14:47:22 -0400

Source diff to previous version
CVE-2019-14287 Potential bypass of Runas user restrictions

Version: 1.8.16-0ubuntu1.7 2019-06-11 19:06:16 UTC

  sudo (1.8.16-0ubuntu1.7) xenial-security; urgency=medium

  * debian/patches/terminate-with-commands-signal.patch: re-enable patch
    that got dropped by mistake in previous upload. (LP: #1832257)

 -- Marc Deslauriers <email address hidden> Mon, 10 Jun 2019 15:42:44 -0400

Source diff to previous version
1832257 regression: sudo returns exit code 0 if child is killed with SIGTERM

Version: 1.8.16-0ubuntu1.6 2019-05-06 19:07:19 UTC

  sudo (1.8.16-0ubuntu1.6) xenial-security; urgency=medium

  [ Steve Beattie ]
  * SECURITY UPDATE: /proc/self/stat parsing newline confusion
    - debian/patches/CVE-2017-1000368.patch: read all lines of
      /proc/self/stat
    - CVE-2017-1000368
  * debian/patches/avoid_sign_extension_tty_nr.patch: hardening to
    ensure sign extension doesn't occur when parsing /proc/self/stat

  [ Marc Deslauriers ]
  * SECURITY UPDATE: sudo noexec bypass
    - debian/patches/CVE-2016-7076-*.patch: wrap wordexp, add seccomp
      filter.
    - CVE-2016-7076

 -- Marc Deslauriers <email address hidden> Wed, 01 May 2019 11:30:39 -0400

Source diff to previous version
CVE-2017-1000368 Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function result
CVE-2016-7076 sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library functi

Version: 1.8.16-0ubuntu1.5 2017-07-26 16:06:49 UTC

  sudo (1.8.16-0ubuntu1.5) xenial; urgency=medium

  * Terminate with the same signal as the command (LP: #1686803)
    This fixes a regression introduced in sudo 1.8.15 changeset
    10229:153f016db8f1.

 -- Balint Reczey <email address hidden> Tue, 13 Jun 2017 11:10:50 +0200

Source diff to previous version
1686803 sudo returns exit code 0 if child is killed with SIGTERM

Version: 1.8.16-0ubuntu1.4 2017-05-30 17:06:41 UTC

  sudo (1.8.16-0ubuntu1.4) xenial-security; urgency=medium

  * SECURITY UPDATE: /proc/self/stat parsing confusion
    - debian/patches/CVE-2017-1000367.patch: adjust parsing to
      find ttyname
    - CVE-2017-1000367

 -- Steve Beattie <email address hidden> Mon, 29 May 2017 03:17:46 -0700

CVE-2017-1000 RESERVED



About   -   Send Feedback to @ubuntu_updates