CVE-2012-0809
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local...
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
- Record
CVE-2012-0809- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
- Record
CVE-2012-0809- Updated
- 2026-11-02
EUVDEUVD-2012-0836 No score
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
- Record
EUVD-2012-0836- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6785-8cf2-mmj4 No score
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local...
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
- Record
GHSA-6785-8cf2-mmj4- Weakness
- CWE-134
- Updated
- 2026-11-02
OSV No score
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
- Record
CVE-2012-0809- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-0809 No score
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.
- Record
DEBIAN-CVE-2012-0809- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | sudo 1.8.0 < 1.8.3p1 - Format String | 2012-01-31 |
| Exploit-DB | sudo 1.8.0 < 1.8.3p1 - 'sudo_debug' glibc FORTIFY_SOURCE Bypass + Privilege Escalation | 2013-05-01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-0809 is a high vulnerability (CVSS 7.2) in Todd Miller Sudo, published February 1, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.93%, the 87th percentile. Fixed in sudo 1.8.3p2-1.
References
security.gentoo.org/glsa/glsa-201203-06.xml
archives.neohapsis.com/archives/fulldisclosure/2012-01/att-0591/advisory_sudo.txt
sudo.ws/sudo/alerts/sudo_debug.html
nvd.nist.gov/vuln/detail/CVE-2012-0809
github.com/advisories/GHSA-6785-8cf2-mmj4
security-tracker.debian.org/tracker/CVE-2012-0809