CVE-2016-7091

Description

sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

Weakness classification

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory