Canonical Accountsservice vulnerabilities

6 vulnerabilities

Known vulnerabilities in Canonical Accountsservice, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.8CVE-2021-3939canonicalaccountsservice+3
EPSS score
0.37%
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.5.5CVE-2022-1804canonicalaccountsservice+3
EPSS score
0.14%
accountsservice no longer drops permissions when writting .pam_environment3.6CVE-2011-4406canonicalaccountsservice+2
EPSS score
0.38%
The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.7.8CVE-2026-61898canonicalaccountsservice+1
EPSS score
0.19%
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.7.8CVE-2026-61897canonicalaccountsservice+1
EPSS score
0.14%
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.8.1CVE-2023-3297canonicalaccountsservice+2
EPSS score
0.33%
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.