CVE-2010-2956: todd_miller sudo

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

0.00 pp

From 0.36% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

29 links

www.vupen.com/english/advisories/2010/2312VDB EntryX Refsource VUPEN
bugzilla.redhat.com/show_bug.cgi?id=628628X Refsource CONFIRMREPORT
www.vupen.com/english/advisories/2010/2318VDB EntryX Refsource VUPEN
www.vmware.com/security/advisories/VMSA-2011-0001.htmlX Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2010:175Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2010/2320VDB EntryX Refsource VUPEN
www.securityfocus.com/archive/1/514489/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2010/2358VDB EntryX Refsource VUPEN
www.sudo.ws/sudo/alerts/runas_group.htmlX Refsource CONFIRMVendor Advisory
wiki.rpath.com/Advisories:rPSA-2010-0075X Refsource CONFIRM

Show all 29 references

lists.fedoraproject.org/pipermail/package-announce/2010-September/047516.htmlVendor AdvisoryX Refsource FEDORA
security.gentoo.org/glsa/glsa-201009-03.xmlVendor AdvisoryX Refsource GENTOO
www.securityfocus.com/archive/1/515545/100/0/threadedMailing ListX Refsource BUGTRAQ
lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/bid/43019VDB EntryX Refsource BID
www.redhat.com/support/errata/RHSA-2010-0675.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/40508Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1024392VDB EntryX Refsource SECTRACK
secunia.com/advisories/42787Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2011/0025VDB EntryX Refsource VUPEN
www.ubuntu.com/usn/USN-983-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/41316Third Party AdvisoryX Refsource SECUNIAVendor Advisory
access.redhat.com/errata/RHSA-2010:0675Advisory
www.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0675.jsonAdvisory
access.redhat.com/security/cve/CVE-2010-2956REPORT
www.cve.org/CVERecord?id=CVE-2010-2956Advisory
nvd.nist.gov/vuln/detail/CVE-2010-2956Advisory
security-tracker.debian.org/tracker/CVE-2010-2956Advisory

Related vulnerabilities

CVE-2013-2777applemac_os_x+20.36%13y ago08-04-2013 17:00sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.CVE-2013-2776applemac_os_x+20.37%13y ago08-04-2013 17:00sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.CVE-2013-1776applemac_os_x+50.37%13y ago08-04-2013 17:00sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.CVE-2013-1775applemac_os_x+23.18%13y ago04-03-2013 21:00sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.CVE-2014-0106applemac_os_x+40.34%12y ago11-03-2014 15:00Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.CVE-2005-1119debiansudo+10.36%21y ago16-04-2005 04:00Sudo VISudo 1.6.8 and earlier allows local users to corrupt arbitrary files via a symlink attack on temporary files.

All vulnerabilities insudo

CVE-2010-2956: todd_miller sudo

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References