CVE-2014-0106: Apple Mac OS X

Medium severity, CVSS 6.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.

Affected products

• Apple Mac OS X: up to and including 10.10.4
• Todd Miller Sudo: version 1.6.9 only; version 1.6.9p20 only; version 1.6.9p21 only; version 1.6.9p22 only; version 1.6.9p23 only; version 1.7.0 only; …

Published 2014-03-11. Last modified 2026-06-17.