plugins/sudoers/ins_classic.h | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

examples/sudoers | 10 5 + 5 - 0 !
1 file changed, 5 insertions(+), 5 deletions(-)

---

plugins/sudoers/env.c | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 [patch] whitelist dpkg_colors environment variable

lib/util/strtoid.c | 100 53 + 47 - 0 !
1 file changed, 53 insertions(+), 47 deletions(-)

 treat an id of -1 as invalid since that means "no change".
 Fixes CVE-2019-14287.
 Found by Joe Vennix from Apple Information Security.

lib/util/regress/atofoo/atofoo_test.c | 38 28 + 10 - 0 !
plugins/sudoers/regress/testsudoers/test5.out.ok | 2 1 + 1 - 0 !
plugins/sudoers/regress/testsudoers/test5.sh | 2 1 + 1 - 0 !
3 files changed, 30 insertions(+), 12 deletions(-)

 fix test failure in plugins/sudoers/regress/testsudoers/test5.sh
 Fix test failure after fix for CVE-2019-14287 .

src/tgetpass.c | 20 12 + 8 - 0 !
1 file changed, 12 insertions(+), 8 deletions(-)

 fix a buffer overflow when pwfeedback is enabled and input is a not a
 tty. In getln() if the user enters ^U (erase line) and the write(2) fails,
 the remaining buffer size is reset but the current pointer is not. While
 here, fix an incorrect break for erase when write(2) fails. Also disable
 pwfeedback when input is not a tty as it cannot work. CVE-2019-18634 Credit:
 Joe Vennix from Apple Information Security.

plugins/sudoers/timestamp.c | 63 48 + 15 - 0 !
1 file changed, 48 insertions(+), 15 deletions(-)

 [patch] sanity check size when converting the first record to
 TS_LOCKEXCL Coverity CID 206591

[Salvatore Bonaccorso: Backport to 1.8.27:
 - Context changes
 - Drop hunk about copyright years update
 - Cast sizeof(struct timestamp_entry_v1) into ssize_t as 1.8.27 does
   not contain the "Add ssizeof macro that returns ssize_t" change.
]

src/parse_args.c | 18 12 + 6 - 0 !
1 file changed, 12 insertions(+), 6 deletions(-)

 [patch 1/5] reset valid_flags to mode_noninteractive for sudoedit.

This is consistent with how the -e option is handled.
Also reject -H and -P flags for sudoedit as was done in sudo 1.7.
Found by Qualys.

[Salvatore Bonaccorso: Backport to 1.8.27: Context changes]

plugins/sudoers/policy.c | 9 8 + 1 - 0 !
1 file changed, 8 insertions(+), 1 deletion(-)

 [patch 2/5] add sudoedit flag checks in plugin that are consistent
 with front-end.

Don't assume the sudo front-end is sending reasonable mode flags.
These checks need to be kept consistent between the sudo front-end
and the sudoers plugin.

[Salvatore Bonaccorso: Backport to 1.8.27: Context changes]

plugins/sudoers/sudoers.c | 23 18 + 5 - 0 !
1 file changed, 18 insertions(+), 5 deletions(-)

 [patch 3/5] fix potential buffer overflow when unescaping backslashes
 in user_args.

Do not try to unescaping backslashes unless in run mode *and* we are
running the command via a shell.
Found by Qualys.

[Salvatore Bonaccorso: Backport to 1.8.27: Context changes]

plugins/sudoers/timestamp.c | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 [patch 4/5] fix the memset offset when converting a v1 timestamp to
 TS_LOCKEXCL.

We want to zero the struct starting at flags, not type (which was just set).
Found by Qualys.

src/parse_args.c | 10 5 + 5 - 0 !
1 file changed, 5 insertions(+), 5 deletions(-)

 [patch 5/5] don't assume that argv is allocated as a single flat
 buffer.

While this is how the kernel behaves it is not a portable assumption.
The assumption may also be violated if getopt_long(3) permutes arguments.
Found by Qualys.

[Salvatore Bonaccorso: Backport to 1.8.27: Context changes]