CVE-2016-7091

MEDIUM

Red Hat Enterprise Linux - Unauthorized Information Exposure via INPUTRC Environment Variable

Title source: llm

Description

sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/92615

Patch, Vendor Advisory vendor-advisory x_refsource_redhat

https://rhn.redhat.com/errata/RHSA-2016-2593.html

Third Party Advisory mailing-list x_refsource_mlist

https://lists.gnu.org/archive/html/bug-readline/2016-05/msg00009.html

Scores

CVSS v3 4.4

EPSS 0.0040

EPSS Percentile 32.3%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (5)

redhat/enterprise_linux

redhat/enterprise_linux_desktop 7.0

redhat/enterprise_linux_hpc_node 7.0

redhat/enterprise_linux_server 7.0

redhat/enterprise_linux_workstation 7.0

Published Dec 22, 2016

Tracked Since Feb 18, 2026