CVE-2014-0106

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment...

6.6 MediumFix available

CVE-2014-0106 is a medium vulnerability (CVSS 6.6) in Todd Miller Sudo, published March 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in sudo 1.8.5p2-1.

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Exploit likelihood

0.34%Down 4.5 points since Feb 4, 2022

What each source reports

NVD Score used 6.6

Record: CVE-2014-0106
CVSS 2.0: 6.6 MediumAV:L/AC:M/Au:S/C:C/I:C/A:C
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-0106
Updated: 2026-11-02

EUVDEUVD-2014-0185 No score

Record: EUVD-2014-0185
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cxvm-3g7g-7vv7 No score

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment...

Record: GHSA-cxvm-3g7g-7vv7
Weakness: CWE-20
Updated: 2026-11-02

OSV No score

Record: CVE-2014-0106
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-0106 No score

Record: DEBIAN-CVE-2014-0106
Updated: 2026-11-02

OSVSUSE-SU-2015:0985-1 No score

Security update for sudo

This collective update for sudo provides fixes for the following issues:

* Security policy bypass when env_reset is disabled. (CVE-2014-0106,
  bnc#866503)
* Regression in the previous update that causes a segmentation fault
  when running 'sudo -s'. (bnc#868444)
* Command 'who -m' prints no output when using log_input/log_output
  sudo options. (bnc#863025)

Security Issues references:

* CVE-2014-0106
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0106>

Record: SUSE-SU-2015:0985-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`sudo` Debian:12	before 1.8.5p2-1	1.8.5p2-1
`sudo` Debian:13	before 1.8.5p2-1	1.8.5p2-1
`sudo` Debian:14	before 1.8.5p2-1	1.8.5p2-1
`sudo` Debian:6.0	before 1.7.4p4-2.squeeze.5, plus listed versions 1.7.4p4-2.squeeze.11.7.4p4-2.squeeze.21.7.4p4-2.squeeze.31.7.4p4-2.squeeze.4	1.7.4p4-2.squeeze.5
`sudo` Red Hat:enterprise_linux:5::client	before 0:1.7.2p1-29.el5_10	0:1.7.2p1-29.el5_10
`sudo-debuginfo` Red Hat:enterprise_linux:5::client	before 0:1.7.2p1-29.el5_10	0:1.7.2p1-29.el5_10
`sudo` Red Hat:enterprise_linux:5::server	before 0:1.7.2p1-29.el5_10	0:1.7.2p1-29.el5_10
`sudo-debuginfo` Red Hat:enterprise_linux:5::server	before 0:1.7.2p1-29.el5_10	0:1.7.2p1-29.el5_10

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 24 moreShow less