Thomas Perale 54de8d26d0 package/sudo: backport patch CVE-2026-35535 ...

This backport is provided thanks to the Debian community [1].

- CVE-2026-35535:
    In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid,
    setgid, or setgroups call, during a privilege drop before running the
    mailer, is not a fatal error and can lead to privilege escalation.

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-35535

[1] https://salsa.debian.org/sudo-team/sudo/-/blob/debian/trixie/debian/patches/0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>

2026-06-30 16:16:37 +02:00

..

0001-exec-mailer-set-group-as-well-as-uid-when-running-the-mailer.patch

…

Config.in

…

sudo.hash

…

sudo.mk

…

sudo.pam

…