Skip to content
OpenAdvisories

Package · Ubuntu

accountsservice

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.8
    CVE-2026-61898

    accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts

    The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU…

    Canonical accountsservice accountsservice Ubuntu
  • High 7.8
    CVE-2026-61897

    accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

    An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper …

    Canonical accountsservice accountsservice Ubuntu
  • High 8.1
    CVE-2023-3297

    In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservic…

    Canonical AccountService accountsservice accountsservice Ubuntu Azure Linux
  • High 7.8
    CVE-2021-3939

    Free of static data in accountsservice

    Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the…

    Ubuntu accountsservice accountsservice Ubuntu