Description
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | accountsservice | 22.07.5-2ubuntu1 – < 22.07.5-2ubuntu1.6, 23.13.9-2ubuntu6 – < 23.13.9-2ubuntu6.1, 23.13.9-8ubuntu5 – < 23.13.9-8ubuntu5.2, 23.13.9-8ubuntu6 – < 23.13.9-8ubuntu7 | 22.07.5-2ubuntu1.6 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | accountsservice | 23.13.9-8ubuntu5.2 | — |
| Ubuntu 24.04 LTS | accountsservice | 23.13.9-2ubuntu6.1 | — |
| Ubuntu 22.04 LTS | accountsservice | 22.07.5-2ubuntu1.6 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | accountsservice | 0.6.55-0ubuntu12~20.04.7+esm1 | — |
| Ubuntu Pro 18.04 LTS | accountsservice | 0.6.45-1ubuntu1.3+esm2 | — |
| Ubuntu Pro 16.04 LTS | accountsservice | 0.6.40-2ubuntu11.6+esm2 | — |
| Ubuntu Pro 14.04 LTS | accountsservice | 0.6.35-0ubuntu7.3+esm4 | — |
References
- Launchpad Bug #2157985 issue-tracking
- Ubuntu CVE Tracker vendor-advisory