CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.

• CWE-200

• http://openwall.com/lists/oss-security/2014/10/15/24Exploit, Mailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1409.html
• http://www.securitytracker.com/id/1033158
• http://www.sudo.ws/alerts/tz.htmlVendor Advisory
• https://security.gentoo.org/glsa/201504-02
• http://openwall.com/lists/oss-security/2014/10/15/24Exploit, Mailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1409.html
• http://www.securitytracker.com/id/1033158
• http://www.sudo.ws/alerts/tz.htmlVendor Advisory
• https://security.gentoo.org/glsa/201504-02

Published

Apr 24, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9674The Mac_Read_POST_Resource function in base/ftobjs.c in Free…
• CVE-2014-9675bdf/bdflib.c in FreeType before 2.5.4 identifies property na…
• CVE-2014-9676The seg_write_packet function in libavformat/segment.c in ff…
• CVE-2014-9677Cross-site scripting (XSS) vulnerability in FlexPaperViewer.…
• CVE-2014-9678FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote …
• CVE-2014-9679Integer underflow in the cupsRasterReadPixels function in fi…
• CVE-2014-9681Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-9682The dns-sync module before 0.1.1 for node.js allows context-…
• CVE-2014-9683Off-by-one error in the ecryptfs_decode_from_filename functi…
• CVE-2014-9684OpenStack Image Registry and Delivery Service (Glance) 2014.…
• CVE-2014-9685Multiple cross-site scripting (XSS) vulnerabilities in Vanil…
• CVE-2014-9686The Googlemaps plugin 3.2 and earlier for Joomla! allows rem…