Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (9)
| Vulnerability |
Summary |
Aliases |
|
VCID-4wd1-kxpx-9ugm
|
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.
|
CVE-2020-16127
|
|
VCID-84wd-4hfs-cbdm
|
The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.
|
CVE-2011-4406
|
|
VCID-91vz-futd-tkfa
|
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
|
CVE-2012-2737
|
|
VCID-bqzt-u1sk-3fht
|
accountsservice no longer drops permissions when writting .pam_environment
|
CVE-2022-1804
|
|
VCID-bxkw-9x1u-sbhm
|
accountsservice: use-after-free via a D-Bus message to the accounts-daemon process
|
CVE-2023-3297
|
|
VCID-chd6-4yfy-x7hg
|
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.
|
CVE-2020-16126
|
|
VCID-p9ht-pahu-wbea
|
accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c
|
CVE-2018-14036
|
|
VCID-pnj9-7czc-pqfc
|
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.
|
CVE-2021-3939
|
|
VCID-y4tn-cs9p-v7eh
|
accountsservice: local encrypted password disclosure when changing password
|
CVE-2012-6655
|