Debian Patches

Status for sudo/1.9.17p2-9

Patch Description Author Forwarded Bugs Origin Last update
spanish.patch improve spanish program translation Debian Sudo Maintainers <sudo@packages.debian.org> yes https://salsa.debian.org/sudo-team/sudo/-/commit/7f12ddebd18ea2021ace59741f773c9c7b476a27 2025-08-13
paths-in-samples.diff fix paths in sudoers example to match Debian's Bdale Garbee <bdale@gag.com> not-needed 2021-12-13
Whitelist-DPKG_COLORS-environment-variable.diff Whitelist DPKG_COLORS environment variable Guillem Jover <guillem@hadrons.org> not-needed 2016-05-04
X11R6.patch patch docs to correct path to ssh-askpass Marc Haber <mh+debian-packages@zugschlus.de> not-needed 2025-08-13
0008-open_sudoers-Do-not-perform-path-expansion-on-files-.patch open_sudoers: Do not perform path expansion on files in an includedir

A file in an includedir containing one or more colons (':') in the
name we was being expanded as a colon-separated path instead of
being opened as-is. This fixes a regression introduced in
sudo 1.9.14. Bug #1085		 "Todd C. Miller" <Todd.Miller@sudo.ws> no 2026-01-24
0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch exec_mailer: Set group as well as uid when running the mailer
Also make a setuid(), setgid() or setgroups() failure fatal.

Found by the ZeroPath AI Security Engineer <https://zeropath.com>		 "Todd C. Miller" <Todd.Miller@sudo.ws> no 2025-11-08
0007-sudo-ignore-user-specified-TZ-environment-variable.patch sudo: ignore user-specified TZ environment variable
This avoids potential issues caused by a user-specified timezone
when running sudo, such as the parsing of NOTBEFORE/NOTAFTER values
in sudoers. The TZ variable is still passed to the command being
run unless blocked by sudoers rules.

Credit:
- XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com)
- Atuin Automated Vulnerability Discovery Engine
- Guannan Wang, Zhanpeng Liu, Guancheng Li		 "Todd C. Miller" <Todd.Miller@sudo.ws> no 2026-03-14
0008-Remove-TZ-from-sudo-s-working-environment-without-mo.patch Remove TZ from sudo's working environment without modifying envp.
The earlier change to prevent NOTBEFORE/NOTAFTER in sudoers from
being affected by a user-specified timezone was not effective since
the mktime() function re-reads the TZ environment variable each
time it is called.

Reported by Ermenson Junior		 "Todd C. Miller" <Todd.Miller@sudo.ws> no 2026-08-28
0009-Copy-envp-submit_envp-instead-of-replacing-the-envir.patch Copy envp -> submit_envp instead of replacing the environ pointer.
This has the same effect of passing the unmodified environment to
the plugin without needing to manually change the environ pointer.		 "Todd C. Miller" <Todd.Miller@sudo.ws> no 2026-08-30

All known versions for source package 'sudo'

Links