Skip to content
OpenAdvisories
High USN-5149-1 1 CVE

accountsservice vulnerability

Published Nov 16, 2021 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Kevin Backhouse discovered that AccountsService incorrectly handled memory
when performing certain language setting operations. A local attacker could
use this issue to escalate privileges.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS accountsservice 0.6.55-0ubuntu12~20.04.5

Vulnerabilities 1

  • High 7.8
    CVE-2021-3939

    Free of static data in accountsservice

    Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the…

    Ubuntu accountsservice accountsservice Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2021-3939