Log in Start free

Vulnerability · Published Nov 17, 2021 · Assigned by canonical

CVE-2021-3939Free of static data in accountsservice

High 7.8

In plain English

A high-severity security flaw in accountsservice from Ubuntu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 68.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSaccountsservice0.6.55-3ubuntu2UBUNTU-CVE-2021-3939

Affected products (as reported)

VendorProductVersions
Ubuntu accountsservice 0.6.55-0ubuntu12~20.04 – before 0.6.55-0ubuntu12~20.04.50.6.55-0ubuntu13 – before 0.6.55-0ubuntu13.30.6.55-0ubuntu14 – before 0.6.55-0ubuntu14.1

Weakness: CWE-590 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References