sudo (SUSE:Linux Enterprise Server for SAP Applications 12 SP2) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server for SAP Applications 12 SP2 package sudo, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (8)

• CVE-2019-14287 — CVSS 8.8 (high): In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules…
• CVE-2017-1000368 — CVSS 8.2 (high): Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname()…
• CVE-2021-3156 — CVSS 7.8 (high) — actively exploited: Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root…
• CVE-2019-18634 — CVSS 7.8 (high): In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo…
• CVE-2016-7032 — CVSS 7.0 (high): sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions via an application…
• CVE-2016-7076 — CVSS 6.4 (medium): sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C…
• CVE-2017-1000367 — CVSS 6.4 (medium): Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function…
• CVE-2021-23239 — CVSS 2.5 (low): The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning…