Skip to content
OpenAdvisories
Low USN-4616-2 2 CVEs

accountsservice vulnerabilities

Published Nov 4, 2020 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

USN-4616-1 fixed several vulnerabilities in AccountsService. This update provides
the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Kevin Backhouse discovered that AccountsService incorrectly dropped
privileges. A local user could possibly use this issue to cause
AccountsService to crash or hang, resulting in a denial of service.
(CVE-2020-16126)

Matthias Gerstner discovered that AccountsService incorrectly handled
certain path checks. A local attacker could possibly use this issue to
read arbitrary files. (CVE-2018-14036)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS accountsservice 0.6.35-0ubuntu7.3+esm2

Vulnerabilities 2

  • Low 3.3
    CVE-2020-16126 Public exploit

    accountsservice drops ruid, allows unprivileged users to send it signals

    An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a…

    Freedesktop accountsservice accountsservice Ubuntu
  • Unscored —
    CVE-2018-14036

    Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in…

    accountsservice accountsservice Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2018-14036
  • report
    https://ubuntu.com/security/CVE-2020-16126