CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for…

published April 24, 2017

CVSS
—
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Published
2017-04-24T06:12Z
EPSS history
Timeline
  • 24 APR 06:12Z
    sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for…
    cvelistv5