Every CVESearch/Get API key

CVE-2014-0106

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment...

6.6 MediumFix available

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Exploit likelihood

0.34%Down 4.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used6.6

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Record
CVE-2014-0106
CVSS 2.0
6.6 MediumAV:L/AC:M/Au:S/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Record
CVE-2014-0106
Updated
2026-11-02
EUVDEUVD-2014-0185No score

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Record
EUVD-2014-0185
Updated
2026-11-03
GitHub AdvisoriesGHSA-cxvm-3g7g-7vv7No score

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment...

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Record
GHSA-cxvm-3g7g-7vv7
Weakness
CWE-20
Updated
2026-11-02
OSVNo score

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Record
CVE-2014-0106
Updated
2026-11-02
OSVDEBIAN-CVE-2014-0106No score

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Record
DEBIAN-CVE-2014-0106
Updated
2026-11-02
OSVSUSE-SU-2015:0985-1No score

Security update for sudo

This collective update for sudo provides fixes for the following issues:

* Security policy bypass when env_reset is disabled. (CVE-2014-0106,
  bnc#866503)
* Regression in the previous update that causes a segmentation fault
  when running 'sudo -s'. (bnc#868444)
* Command 'who -m' prints no output when using log_input/log_output
  sudo options. (bnc#863025)

Security Issues references:

* CVE-2014-0106
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106>
Record
SUSE-SU-2015:0985-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sudo
Debian:12
before 1.8.5p2-1
1.8.5p2-1
sudo
Debian:13
before 1.8.5p2-1
1.8.5p2-1
sudo
Debian:14
before 1.8.5p2-1
1.8.5p2-1
sudo
Debian:6.0
From an advisory covering 2 CVEs
before 1.7.4p4-2.squeeze.5, plus listed versions
1.7.4p4-2.squeeze.11.7.4p4-2.squeeze.21.7.4p4-2.squeeze.31.7.4p4-2.squeeze.4
1.7.4p4-2.squeeze.5
sudo
Red Hat:enterprise_linux:5::client
before 0:1.7.2p1-29.el5_10
0:1.7.2p1-29.el5_10
sudo-debuginfo
Red Hat:enterprise_linux:5::client
before 0:1.7.2p1-29.el5_10
0:1.7.2p1-29.el5_10
sudo
Red Hat:enterprise_linux:5::server
before 0:1.7.2p1-29.el5_10
0:1.7.2p1-29.el5_10
sudo-debuginfo
Red Hat:enterprise_linux:5::server
before 0:1.7.2p1-29.el5_10
0:1.7.2p1-29.el5_10

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0106 is a medium vulnerability (CVSS 6.6) in Todd Miller Sudo, published March 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in sudo 1.8.5p2-1.

References

Show 24 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open