← Back

CVE-2025-32463

nvd nistnuclei
Published: Jun 30, 2025Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

Affected (18)

Show all products
Sudo Project: Sudo · Canonical: Ubuntu Linux · Debian: Debian Linux · Opensuse: Leap · Redhat: Enterprise Linux · Suse: Linux Enterprise Desktop, Linux Enterprise Real Time, Linux Enterprise Server For Sap
Sudo Project
1 product
Sudo
Canonical
1 product
Ubuntu Linux
Debian
1 product
Debian Linux
Opensuse
1 product
Leap
Redhat
1 product
Enterprise Linux
Suse
3 products
Linux Enterprise Desktop
Linux Enterprise Real Time
Linux Enterprise Server For Sap
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Sudo Project
Sudo
From 1.9.14 to 1.9.17
Sudo
Version 1.9.17
Configuration B
16 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 22.04
Ubuntu Linux
Version 24.04
Ubuntu Linux
Version 24.10
Ubuntu Linux
Version 25.04
Debian
Debian Linux
Version 11.0
Debian Linux
Version 12.0
Debian Linux
Version 13.0
Leap
Version 15.6
Enterprise Linux
Version 10.0
Suse
Linux Enterprise Desktop
Version 15 sp6
Linux Enterprise Desktop
Version 15 sp7
Suse
Linux Enterprise Real Time
Version 15.0 sp2
Linux Enterprise Real Time
Version 15.0 sp6
Linux Enterprise Real Time
Version 15.0 sp7
Suse
Linux Enterprise Server For Sap
Version 12 sp6
Linux Enterprise Server For Sap
Version 12 sp7

Related CWEs

CWE-829
Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References (17)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Issue TrackingThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
MitigationThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.