CVE-2010-2956: Todd Miller Sudo

Medium severity, CVSS 6.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.

Affected products

• Todd Miller Sudo: version 1.7.0 only; version 1.7.1 only; version 1.7.2 only; version 1.7.2p1 only; version 1.7.2p2 only; version 1.7.2p3 only; …

Published 2010-09-10. Last modified 2026-06-16.