| Package | Affected versions | Patched versions |
|---|---|---|
| accountsservice | = 0.4= 0.5= 0.6= 0.6.1= 0.6.10= 0.6.11= 0.6.12= 0.6.13= 0.6.14= 0.6.15= 0.6.16= 0.6.17= 0.6.18= 0.6.19= 0.6.2= 0.6.20= 0.6.3= 0.6.4= 0.6.5= 0.6.6= 0.6.7= 0.6.8= 0.6.9≤ 0.6.21 |
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free