UnratedFix available
sudo — security advisory
The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.
- Products
- sudo
- Affected versions
- Not specified
- Fixed versions
- 1.7.2p7-1
- CVEs
- CVE-2010-1646
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:59 UTC · Revision 1
Source evidence
The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.
osv:DEBIAN-CVE-2010-1646
sudo
Fixed versions: 1.7.2p7-1
sudo
Fixed versions: 1.7.2p7-1
sudo
Fixed versions: 1.7.2p7-1
Complete source record
{
"id": "2c3e4f6cd209e4bc5c2368705524509b9eac20c959804d9908415cbe25e7e3fd",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2010-1646",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2010-1646",
"summary": "The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable.",
"evidence": "osv:DEBIAN-CVE-2010-1646",
"products": [
{
"name": {
"value": "sudo",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.7.2p7-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "sudo",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.7.2p7-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "sudo",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.7.2p7-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2010-1646",
"aliases": [
"DEBIAN-CVE-2010-1646"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.2p7-1"
}
]
}
],
"package": {
"name": "sudo",
"purl": "pkg:deb/debian/sudo?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1646.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.2p7-1"
}
]
}
],
"package": {
"name": "sudo",
"purl": "pkg:deb/debian/sudo?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1646.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.2p7-1"
}
]
}
],
"package": {
"name": "sudo",
"purl": "pkg:deb/debian/sudo?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2010-1646.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:31.434914145Z",
"provider": "osv",
"upstream": [
"CVE-2010-1646"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2010-1646"
]
},
"related_cves": [
{
"value": "CVE-2010-1646",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 417409,
"published_at": "2010-06-07T17:12:48.123+00:00"
}