← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2012-0809

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2012-0809
1
 
Candidate: CVE-2012-0809
2
 
PublicDate: 2012-01-31
3
 
References: 
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0809
5
 
 http://www.gratisoft.us/sudo/alerts/sudo_debug.html
6
 
Description:
7
 
 Format string vulnerability in the sudo_debug function in Sudo 1.8.0
8
 
 through 1.8.3p1 allows local users to execute arbitrary code via format
9
 
 string sequences in the program name for sudo.
10
 
Ubuntu-Description: 
11
 
Notes: 
12
 
 jdstrand> per upstream, introduced in 1.8, so only 12.04 affected
13
 
 jdstrand> -D_FORTIFY_SOURCE=2 in combination with ASLR and NX should
14
 
  adequately protect against this until an update is provided
15
 
Bugs:
16
 
Priority: low
17
 
Discovered-by:
18
 
Assigned-to: mdeslaur
19
 
 
20
 
Tags_sudo_precise: fortify-source
21
 
Patches_sudo:
22
 
upstream_sudo: released (1.8.3p2)
23
 
hardy_sudo: not-affected
24
 
lucid_sudo: not-affected
25
 
maverick_sudo: not-affected
26
 
natty_sudo: not-affected
27
 
oneiric_sudo: not-affected (1.7.4p6-1ubuntu2)
28
 
devel_sudo: released (1.8.3p1-1ubuntu3)