File _patchinfo of Package patchinfo.1638

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.1638

<patchinfo incident="1638">
  <issue id="917806" tracker="bnc">VUL-1: sudo: CVE-2014-9680 sudo: unsafe handling of TZ environment variable</issue>
  <issue id="1007766" tracker="bnc">VUL-0: CVE-2016-7032: sudo: noexec bypass via system() and popen()</issue>
  <issue id="1007501" tracker="bnc">VUL-0: CVE-2016-7076: sudo: noexec bypass via wordexp()</issue>
  <issue id="899252" tracker="bnc">sudo: "ignoring time stamp from the future" message after each boot with !tty_tickets</issue>
  <issue id="979531" tracker="bnc">sudo: use_sasl does not work</issue>
  <issue id="2014-9680" tracker="cve" />
  <issue id="2016-7032" tracker="cve" />
  <issue id="2016-7076" tracker="cve" />
  <category>security</category>
  <rating>moderate</rating>
  <packager>kstreitova</packager>
  <description>
This update for sudo fixes the following security issues:

- Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality:
  * noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766]
  * noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501]
- Fix unsafe handling of TZ environment variable. [CVE-2014-9680, bsc#917806]

Additionally, these non-security fixes are included in the update:

- Fix "ignoring time stamp from the future" message after each boot with !tty_tickets. [bsc#899252]
- Enable support for SASL-based authentication. [bsc#979531]
</description>
  <summary>Security update for sudo</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.1638

Places