Format: 1.8
Date: Tue, 19 Jan 2021 09:48:09 -0500
Source: sudo
Binary: sudo sudo-ldap
Architecture: source i386
Version: 1.8.16-0ubuntu1.10
Distribution: xenial-security
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers@ubuntu.com>
Description: 
 sudo       - Provide limited super user privileges to specific users
 sudo-ldap  - Provide limited super user privileges to specific users
Changes: 
 sudo (1.8.16-0ubuntu1.10) xenial-security; urgency=medium
 .
   * SECURITY UPDATE: dir existence issue via sudoedit race
     - debian/patches/CVE-2021-23239.patch: fix potential directory existing
       info leak in sudoedit in src/sudo_edit.c.
     - CVE-2021-23239
   * SECURITY UPDATE: heap-based buffer overflow
     - debian/patches/CVE-2021-3156-pre1.patch: check lock record size in
       plugins/sudoers/timestamp.c.
     - debian/patches/CVE-2021-3156-pre2.patch: sanity check size when
       converting the first record to TS_LOCKEXCL in
       plugins/sudoers/timestamp.c.
     - debian/patches/CVE-2021-3156-1.patch: reset valid_flags to
       MODE_NONINTERACTIVE for sudoedit in src/parse_args.c.
     - debian/patches/CVE-2021-3156-2.patch: add sudoedit flag checks in
       plugin in plugins/sudoers/policy.c.
     - debian/patches/CVE-2021-3156-3.patch: fix potential buffer overflow
       when unescaping backslashes in plugins/sudoers/sudoers.c.
     - debian/patches/CVE-2021-3156-4.patch: fix the memset offset when
       converting a v1 timestamp to TS_LOCKEXCL in
       plugins/sudoers/timestamp.c.
     - debian/patches/CVE-2021-3156-5.patch: don't assume that argv is
       allocated as a single flat buffer in src/parse_args.c.
     - CVE-2021-3156
Checksums-Sha1: 
 69c8cda6fc4e30d0dbd781bde55b75d243a5bd70 1213 sudo_1.8.16-0ubuntu1.10.dsc
 c6c5abb2bf412216f6b67ce07cc6e9dfd6c05f39 55524 sudo_1.8.16-0ubuntu1.10.debian.tar.gz
 d2089a2dc8261264f400b92fadff8b6d3bae6424 983654 sudo_1.8.16-0ubuntu1.10_i386.deb
 92b1e6d8e9cf0d124372de070899f719edf8c8cb 1012460 sudo-ldap_1.8.16-0ubuntu1.10_i386.deb
Checksums-Sha256: 
 85eff6be3449b80856ca058350ae38c59dc8c2d926c70be00f9aa1106390022a 1213 sudo_1.8.16-0ubuntu1.10.dsc
 18bcff2dfd9ce3312f3a797cfefaaa235db8b96b7cf4325ce71ae536aa4bb8c1 55524 sudo_1.8.16-0ubuntu1.10.debian.tar.gz
 93a583c695dc17d75c1e359de2beb7bd51ad4ee10a2887dafd95d4d1b8a19dac 983654 sudo_1.8.16-0ubuntu1.10_i386.deb
 80db1af9362326e8f18f4c94ef6f42d5a413fe9e411fb393001e5344b661b4a5 1012460 sudo-ldap_1.8.16-0ubuntu1.10_i386.deb
Files: 
 1d046a74ceddf557f82212fc4b6dee0d 1213 admin optional sudo_1.8.16-0ubuntu1.10.dsc
 e049e1728d9a337cd913af996cbdf969 55524 admin optional sudo_1.8.16-0ubuntu1.10.debian.tar.gz
 dd3939adaae6d67e790d4b5ec41dd164 983654 admin optional sudo_1.8.16-0ubuntu1.10_i386.deb
 8164a371d9ca3b9e2f121313b650e53d 1012460 admin optional sudo-ldap_1.8.16-0ubuntu1.10_i386.deb
Original-Maintainer: Bdale Garbee <bdale@gag.com>