UbuntuUpdates.org

Package "sudo"

Name: sudo

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Provide limited super user privileges to specific users

Latest version: 1.8.16-0ubuntu1.9
Release: xenial (16.04)
Level: updates
Repository: universe

Links



Other versions of "sudo" in Xenial

Repository Area Version
base universe 1.8.16-0ubuntu1
base main 1.8.16-0ubuntu1
security universe 1.8.16-0ubuntu1.9
security main 1.8.16-0ubuntu1.9
updates main 1.8.16-0ubuntu1.9

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.8.16-0ubuntu1.9 2020-02-03 15:07:08 UTC

  sudo (1.8.16-0ubuntu1.9) xenial-security; urgency=medium

  * SECURITY UPDATE: buffer overflow in sudo when pwfeedback is enabled
    - debian/patches/CVE-2019-18634.patch: fix overflow in src/tgetpass.c.
    - CVE-2019-18634

 -- Marc Deslauriers <email address hidden> Fri, 31 Jan 2020 12:19:11 -0500

Source diff to previous version
CVE-2019-18634 In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwf

Version: 1.8.16-0ubuntu1.8 2019-10-14 17:07:10 UTC

  sudo (1.8.16-0ubuntu1.8) xenial-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via UID -1
    - debian/patches/CVE-2019-14287.patch: treat an ID of -1 as invalid
      in lib/util/strtoid.c.
    - CVE-2019-14287
    - debian/patches/CVE-2019-14287-2.patch: fix and add to tests in
      lib/util/regress/atofoo/atofoo_test.c,
      plugins/sudoers/regress/testsudoers/test5.out.ok,
      plugins/sudoers/regress/testsudoers/test5.sh.
    - CVE-2019-14287

 -- Marc Deslauriers <email address hidden> Thu, 10 Oct 2019 14:47:22 -0400

Source diff to previous version
CVE-2019-14287 Potential bypass of Runas user restrictions

Version: 1.8.16-0ubuntu1.7 2019-06-11 14:06:15 UTC

  sudo (1.8.16-0ubuntu1.7) xenial-security; urgency=medium

  * debian/patches/terminate-with-commands-signal.patch: re-enable patch
    that got dropped by mistake in previous upload. (LP: #1832257)

 -- Marc Deslauriers <email address hidden> Mon, 10 Jun 2019 15:42:44 -0400

Source diff to previous version
1832257 regression: sudo returns exit code 0 if child is killed with SIGTERM

Version: 1.8.16-0ubuntu1.6 2019-05-06 19:07:21 UTC

  sudo (1.8.16-0ubuntu1.6) xenial-security; urgency=medium

  [ Steve Beattie ]
  * SECURITY UPDATE: /proc/self/stat parsing newline confusion
    - debian/patches/CVE-2017-1000368.patch: read all lines of
      /proc/self/stat
    - CVE-2017-1000368
  * debian/patches/avoid_sign_extension_tty_nr.patch: hardening to
    ensure sign extension doesn't occur when parsing /proc/self/stat

  [ Marc Deslauriers ]
  * SECURITY UPDATE: sudo noexec bypass
    - debian/patches/CVE-2016-7076-*.patch: wrap wordexp, add seccomp
      filter.
    - CVE-2016-7076

 -- Marc Deslauriers <email address hidden> Wed, 01 May 2019 11:30:39 -0400

Source diff to previous version
CVE-2017-1000368 Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function result
CVE-2016-7076 sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library functi

Version: 1.8.16-0ubuntu1.5 2017-07-26 16:06:51 UTC

  sudo (1.8.16-0ubuntu1.5) xenial; urgency=medium

  * Terminate with the same signal as the command (LP: #1686803)
    This fixes a regression introduced in sudo 1.8.15 changeset
    10229:153f016db8f1.

 -- Balint Reczey <email address hidden> Tue, 13 Jun 2017 11:10:50 +0200

1686803 sudo returns exit code 0 if child is killed with SIGTERM



About   -   Send Feedback to @ubuntu_updates