CVE-2002-0043
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail...
CVE-2002-0043 is a high vulnerability (CVSS 7.2) in Todd Miller Sudo, published January 31, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 61st percentile. No source names a fixed version.
- Severity
- 7.2 HighCVSS 2.0, NVD
- Exploit chance
- 0.93%EPSS, 61st percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Sudo 1.6.3 - Unclean Environment Variable Privilege Escalation | 2002-01-14 |
What each source reports
NVD Score used
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
- Record
CVE-2002-0043- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
- Record
CVE-2002-0043- Updated
- 2026-11-02
EUVDEUVD-2002-0043No score
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
- Record
EUVD-2002-0043- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jc33-cg9p-57rjNo score
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail...
sudo 1.6.0 through 1.6.3p7 does not properly clear the environment before calling the mail program, which could allow local users to gain root privileges by modifying environment variables and changing how the mail program is invoked.
- Record
GHSA-jc33-cg9p-57rj- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
redhat.com/support/errata/RHSA-2002-013.html
exchange.xforce.ibmcloud.com/vulnerabilities/7891
securityfocus.com/advisories/3800
marc.info?l=bugtraq&m=101120193627756&w=2
Show 8 moreShow less
sudo.ws/sudo/alerts/postfix.html
novell.com/linux/security/advisories/2002_002_sudo_txt.html
frontal2.mandriva.com/security/advisories?name=MDKSA-2002:003
debian.org/security/2002/dsa-101
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000451
nvd.nist.gov/vuln/detail/CVE-2002-0043
github.com/advisories/GHSA-jc33-cg9p-57rj