Description
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ubuntu | accountsservice | 0.6.55-0ubuntu12~20.04 – < 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13 – < 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14 – < 0.6.55-0ubuntu14.1 | 0.6.55-0ubuntu12~20.04.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | accountsservice | 0.6.55-3ubuntu2 | — |
| Ubuntu 20.04 LTS | accountsservice | 0.6.55-0ubuntu12~20.04.5 | USN-5149-1 |
Advisories 1
- USN-5149-1 accountsservice vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026