Yeah! sudo had a pretty good one, anyone could gain root access via it, back in 2012 [1]. I love the irony here though - given how people using Java tend to th

Yeah! sudo had a pretty good one, anyone could gain root access via it, back in 2012 [1]. I love the irony here though - given how people using Java tend to think its unexploitable compared to C/C++ code. This is arguably way worse than a format string exploit. Even user sanitized data gives you full RCE. And via url headers/strings. This feels like a 1990s web era exploit, it's pretty insane. 1: https://www.sudo.ws/security/advisories/sudo_debug/ https://www.sudo.ws/security/advisories/sudo_debug/