MGASA-2015-0079

    Dashboard / Vulnerabilities / MGASA-2015-0079

    MGASA-2015-0079

    Published: 19 Feb 2015Last Modified: 16 Apr 2026
    Upstream:
    CVE-2014-9680

    Summary: Updated sudo packages fix CVE-2014-9680

    Details: Updated sudo packages fix security vulnerability: Prior to sudo 1.8.12, the TZ environment variable was passed through unchecked. Most libc tzset() implementations support passing an absolute pathname in the time zone to point to an arbitrary, user-controlled file. This may be used to exploit bugs in the C library's TZ parser or open files the user would not otherwise have access to. Arbitrary file access via TZ could also be used in a denial of service attack by reading from a file or fifo that will block (CVE-2014-9680). The sudo package has been updated to version 1.8.12, fixing this issue and several other bugs.

    References: https://advisories.mageia.org/MGASA-2015-0079.html, https://bugs.mageia.org/show_bug.cgi?id=15247, http://www.sudo.ws/alerts/tz.html, http://www.sudo.ws/sudo/stable.html

    Affected packages

    Package

    Name: sudo

    Purl: pkg:rpm/mageia/sudo?arch=source&distro=mageia-4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.8.12-1.mga4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High