{"id":"CVE-2023-27320","details":"Sudo before 1.9.13p2 has a double free in the per-command chroot feature.","modified":"2026-08-12T03:51:47.696763137Z","published":"2023-02-28T00:00:00Z","related":["SUSE-SU-2023:1665-1","openSUSE-SU-2024:12795-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"1.9.13p2"}],"source":"DESCRIPTION"}],"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27320.json"},"references":[{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2023/02/28/1"},{"type":"WEB","url":"https://www.sudo.ws/releases/stable/#1.9.13p2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27320.json"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27320"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202309-12"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230413-0009/"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2023/03/01/8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/millert/sudo","events":[{"introduced":"affd3d06d6446a882df582618d5aeda6daa68eb3"},{"fixed":"effed9ecbb54acedcbf32d53d9ebd571498867b4"},{"introduced":"effed9ecbb54acedcbf32d53d9ebd571498867b4"},{"last_affected":"05cab83b1f5d0ff0ed60fee5ea4871c90392f5ec"}],"database_specific":{"cpe":["cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*","cpe:2.3:a:sudo_project:sudo:1.9.13:-:*:*:*:*:*:*","cpe:2.3:a:sudo_project:sudo:1.9.13:p1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.9.8"},{"fixed":"1.9.13"},{"introduced":"1.9.13-NA"},{"last_affected":"1.9.13-NA"},{"introduced":"1.9.13-p1"},{"last_affected":"1.9.13-p1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1.9.13-NA","1.9.13-p1","SUDO_1_9_13p1","SUDO_1_9_13","SUDO_1_9_12p2","SUDO_1_9_12p1","SUDO_1_9_12","SUDO_1_9_11p3","SUDO_1_9_11p2","SUDO_1_9_11p1","SUDO_1_9_11","SUDO_1_9_10","SUDO_1_9_9","SUDO_1_9_8p2","SUDO_1_9_8p1","SUDO_1_9_8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27320.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/sudo-project/sudo","events":[{"introduced":"affd3d06d6446a882df582618d5aeda6daa68eb3"},{"fixed":"effed9ecbb54acedcbf32d53d9ebd571498867b4"},{"introduced":"effed9ecbb54acedcbf32d53d9ebd571498867b4"},{"last_affected":"05cab83b1f5d0ff0ed60fee5ea4871c90392f5ec"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*","cpe:2.3:a:sudo_project:sudo:1.9.13:-:*:*:*:*:*:*","cpe:2.3:a:sudo_project:sudo:1.9.13:p1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.9.8"},{"fixed":"1.9.13"},{"introduced":"1.9.13-NA"},{"last_affected":"1.9.13-NA"},{"introduced":"1.9.13-p1"},{"last_affected":"1.9.13-p1"}]}}],"versions":["1.9.13-NA","1.9.13-p1","v1.9.13p1","SUDO_1_9_13p1","v1.9.13","SUDO_1_9_13","v1.9.12p2","SUDO_1_9_12p2","v1.9.12p1","SUDO_1_9_12p1","v1.9.12","SUDO_1_9_12","v1.9.11p3","SUDO_1_9_11p3","v1.9.11p2","SUDO_1_9_11p2","v1.9.11p1","SUDO_1_9_11p1","v1.9.11","SUDO_1_9_11","v1.9.10","SUDO_1_9_10","v1.9.9","SUDO_1_9_9","v1.9.8p2","SUDO_1_9_8p2","v1.9.8p1","SUDO_1_9_8p1","v1.9.8","SUDO_1_9_8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27320.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}