Search for packages
| purl | pkg:deb/debian/accountsservice@0.6.55-3?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-y4tn-cs9p-v7eh
Aliases: CVE-2012-6655 |
accountsservice: local encrypted password disclosure when changing password |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4wd1-kxpx-9ugm | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location. |
CVE-2020-16127
|
| VCID-84wd-4hfs-cbdm | The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors. |
CVE-2011-4406
|
| VCID-91vz-futd-tkfa | The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition. |
CVE-2012-2737
|
| VCID-bqzt-u1sk-3fht | accountsservice no longer drops permissions when writting .pam_environment |
CVE-2022-1804
|
| VCID-bxkw-9x1u-sbhm | accountsservice: use-after-free via a D-Bus message to the accounts-daemon process |
CVE-2023-3297
|
| VCID-chd6-4yfy-x7hg | An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion. |
CVE-2020-16126
|
| VCID-p9ht-pahu-wbea | accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c |
CVE-2018-14036
|
| VCID-pnj9-7czc-pqfc | Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1. |
CVE-2021-3939
|