Canonical

Accountsservice

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.8

CVE-2026-61898

  • EPSS -
  • Veröffentlicht 20.08.2026 14:32:59
  • Zuletzt bearbeitet 20.08.2026 15:17:38

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped i...

7.8

CVE-2026-61897

  • EPSS -
  • Veröffentlicht 20.08.2026 14:32:53
  • Zuletzt bearbeitet 20.08.2026 15:17:38

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by ...

5.5

CVE-2022-1804

  • EPSS 0.14%
  • Veröffentlicht 25.03.2025 12:28:08
  • Zuletzt bearbeitet 26.08.2025 17:13:47

accountsservice no longer drops permissions when writting .pam_environment

7.8

CVE-2023-3297

Exploit
  • EPSS 0.33%
  • Veröffentlicht 01.09.2023 21:15:07
  • Zuletzt bearbeitet 21.11.2024 08:16:57

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

7.8

CVE-2021-3939

  • EPSS 0.35%
  • Veröffentlicht 17.11.2021 04:15:06
  • Zuletzt bearbeitet 21.11.2024 06:22:49

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachabl...

3.6

CVE-2011-4406

  • EPSS 0.38%
  • Veröffentlicht 16.04.2014 18:37:11
  • Zuletzt bearbeitet 06.05.2026 22:30:45

The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.