CVE-2010-0427

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group...

4.4 MediumFix available

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Exploit likelihood

0.46%Down 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.4

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Record: CVE-2010-0427
CVSS 2.0: 4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Record: CVE-2010-0427
Updated: 2026-11-02

EUVDEUVD-2010-0458 No score

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Record: EUVD-2010-0458
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fvmp-m2wj-xqp8 No score

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group...

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Record: GHSA-fvmp-m2wj-xqp8
Updated: 2026-11-02

OSV No score

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Record: CVE-2010-0427
Updated: 2026-11-02

OSVDEBIAN-CVE-2010-0427 No score

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Record: DEBIAN-CVE-2010-0427
Updated: 2026-11-02

Affected products

todd miller sudo

Affected packages

Affected packages
Package	Affected	Fixed
`sudo` Debian:12	before 1.7.0-1	1.7.0-1
`sudo` Debian:13	before 1.7.0-1	1.7.0-1
`sudo` Debian:14	before 1.7.0-1	1.7.0-1
`sudo` Debian:5.0 From an advisory covering 2 CVEs	before 1.6.9p17-2+lenny1, plus listed versions 1.6.9p17-2	1.6.9p17-2+lenny1
`sudo` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 0:1.6.9p17-6.el5_4	0:1.6.9p17-6.el5_4
`sudo-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 0:1.6.9p17-6.el5_4	0:1.6.9p17-6.el5_4
`sudo` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:1.6.9p17-6.el5_4	0:1.6.9p17-6.el5_4
`sudo-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:1.6.9p17-6.el5_4	0:1.6.9p17-6.el5_4

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-0427 is a medium vulnerability (CVSS 4.4) in Todd Miller Sudo, published February 25, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in sudo 1.7.0-1.

References

Show 26 moreShow less