Root privilege escalation via arbitrary module loading

Privilege escalation in Synacor Zimbra Collaboration Server 8.8.15 P33 and earlier or 9.0.0 P26 and earlier lets local users execute code as root. The sudoers policy authorizes the zimbra account to invoke zmslapd as root with arbitrary arguments, and zmslapd loads shared objects named in an attacker-controlled configuration file. Exploitation requires code execution as the local zimbra service account; a loaded module then runs with unrestricted root privileges.