p PatchFirst

CVE-2019-18634

CVE-2019-18634

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

CVSS 7.8 · High · EPSS 19.3% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • sudo Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.8.31-1

    Update to 1.8.31-1

  • sudo Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.8.31-1

    Update to 1.8.31-1

  • sudo Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.8.31-1

    Update to 1.8.31-1

  • sudo Ubuntu:Pro:14.04:LTS

    Versions
    • 1.8.6p3-0ubuntu3
    • 1.8.8-2ubuntu1
    • 1.8.8-2ubuntu2
    • 1.8.9p4-1ubuntu1
    • 1.8.9p4-1ubuntu2
    • 1.8.9p5-1ubuntu1
    • 1.8.9p5-1ubuntu1.1
    • 1.8.9p5-1ubuntu1.2
    • 1.8.9p5-1ubuntu1.3
    • 1.8.9p5-1ubuntu1.4
    • 1.8.9p5-1ubuntu1.5+esm1
    • 1.8.9p5-1ubuntu1.5+esm2
    Affected ranges
    • ECOSYSTEM: < 1.8.9p5-1ubuntu1.5+esm3

    Update to 1.8.9p5-1ubuntu1.5+esm3

  • sudo Ubuntu:16.04:LTS

    Versions
    • 1.8.12-1ubuntu3
    • 1.8.16-0ubuntu1
    • 1.8.16-0ubuntu1.1
    • 1.8.16-0ubuntu1.2
    • 1.8.16-0ubuntu1.3
    • 1.8.16-0ubuntu1.4
    • 1.8.16-0ubuntu1.5
    • 1.8.16-0ubuntu1.6
    • 1.8.16-0ubuntu1.7
    • 1.8.16-0ubuntu1.8
    Affected ranges
    • ECOSYSTEM: < 1.8.16-0ubuntu1.9

    Update to 1.8.16-0ubuntu1.9

  • sudo Ubuntu:18.04:LTS

    Versions
    • 1.8.20p2-1ubuntu1
    • 1.8.21p2-2ubuntu1
    • 1.8.21p2-3ubuntu1
    • 1.8.21p2-3ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 1.8.21p2-3ubuntu1.2

    Update to 1.8.21p2-3ubuntu1.2

Original sources

Check your server →