CVE-2017-1000368

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 5, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10003694.0Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issuCVE-2017-10003707.8The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments oCVE-2017-10003717.8The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory CVE-2017-10003729.8A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution uCVE-2017-10003736.5The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causeCVE-2017-10003749.8A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution usCVE-2017-10003759.8NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily maCVE-2017-10003767.0libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please noteCVE-2017-10003775.9An issue was discovered in the size of the default stack guard page on PAX Linux (originally from GRSecurity but shipped by other Linux vendCVE-2017-10003789.8The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causesCVE-2017-10003797.8The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped CVE-2017-10003805.5sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users