cbcvebase.

Canonical Accountsservice vulnerabilities

9 known vulnerabilities affecting canonical/accountsservice.

Total CVEs
9
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM4LOW3

Vulnerabilities

Page 1 of 1
CVE-2022-1804MEDIUMCVSS 5.5fixed in 22.07.5-2ubuntu1.32025-03-25
CVE-2022-1804 [MEDIUM] CWE-269 CVE-2022-1804: accountsservice no longer drops permissions when writting .pam_environment accountsservice no longer drops permissions when writting .pam_environment
nvdosv
CVE-2023-3297HIGHCVSS 7.8fixed in 23.13.9-2ubuntu2fixed in 22.08.8-1ubuntu7.1+2 more2023-09-01
CVE-2023-3297 [HIGH] CWE-416 CVE-2023-3297: In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerabilit In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.
nvdosv
CVE-2021-3939HIGHCVSS 7.8≥ 0.6.55-0ubuntu12\~20.04, < 0.6.55-0ubuntu12\~20.05≥ 0.6.55-0ubuntu13, < 0.6.55-0ubuntu13.3+1 more2021-11-17
CVE-2021-3939 [HIGH] CWE-590 CVE-2021-3939: Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.pat Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13
nvdosv
CVE-2020-16126MEDIUMCVSS 6.5≥ 0, < 0.6.40-2ubuntu11.6≥ 0, < 0.6.45-1ubuntu1.3+1 more2020-11-03
CVE-2020-16126 [MEDIUM] accountsservice vulnerabilities accountsservice vulnerabilities Kevin Backhouse discovered that AccountsService incorrectly dropped privileges. A local user could possibly use this issue to cause AccountsService to crash or hang, resulting in a denial of service. (CVE-2020-16126) Kevin Backhouse discovered that AccountsService incorrectly handled reading .pam_environment files. A local user could possibly use this issue to cause AccountsService to crash or hang, resulti
osv
CVE-2020-16127MEDIUMCVSS 5.5≥ 0, < 0.6.55-0ubuntu12~20.04.42020-11-03
CVE-2020-16127 [MEDIUM] CVE-2020-16127: An Ubuntu-specific modification to AccountsService in versions before 0 An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.
osv
CVE-2012-6655LOWCVSS 3.3≥ 0, < 22.08.8-42019-11-27
CVE-2012-6655 [LOW] CVE-2012-6655: An issue exists AccountService 0 An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.
osv
CVE-2018-14036MEDIUMCVSS 6.5≥ 0, < 0.6.45-22018-07-13
CVE-2018-14036 [MEDIUM] CVE-2018-14036: Directory Traversal with Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.
osv
CVE-2011-4406LOWCVSS 3.6≤ 0.6.142014-04-16
CVE-2011-4406 [LOW] CWE-264 CVE-2011-4406: The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges wh The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.
nvdosv
CVE-2012-2737LOWCVSS 1.9≥ 0, < 0.6.21-62012-07-22
CVE-2012-2737 [LOW] CVE-2012-2737: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0 The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
osv