CVE-2023-3297

HIGH 7.8CVE-2023-3297 · Published 01/09/2023 · updated 17/06/2026

In short

CVE-2023-3297 is a HIGH (CVSS 7.8) vulnerability affecting accountsservice (canonical).
Chance of exploitation in the next 30 days (EPSS): 0.33%, higher than 26.2% of all vulnerabilities.
Fix: update to 0.6.55-0ubuntu12\~20.04.6, 22.07.5-2ubuntu1.4, 22.08.8-1ubuntu7.1, 23.13.9-2ubuntu2 or later.

Package	Affected versions	Patched versions
accountsservice canonical	`< 0.6.55-0ubuntu12\~20.04.6< 22.07.5-2ubuntu1.4< 22.08.8-1ubuntu7.1< 23.13.9-2ubuntu2`	`0.6.55-0ubuntu12\~20.04.622.07.5-2ubuntu1.422.08.8-1ubuntu7.123.13.9-2ubuntu2`

Description

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

References

bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182 · Exploit
cve.mitre.org/cgi-bin/cvename.cgi · Third Party Advisory
securitylab.github.com/advisories/GHSL-2023-139_accountsservice · Exploit
ubuntu.com/security/notices/USN-6190-1 · Vendor Advisory

More vulnerabilities in accountsservice

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

accountsservice

canonical

< 0.6.55-0ubuntu12\~20.04.6< 22.07.5-2ubuntu1.4< 22.08.8-1ubuntu7.1< 23.13.9-2ubuntu2

0.6.55-0ubuntu12\~20.04.622.07.5-2ubuntu1.422.08.8-1ubuntu7.123.13.9-2ubuntu2

More vulnerabilities in accountsservice

See all →