HIGH🇵🇱 Wersja polska

CVE-2021-3939

CVSS 7.8v3.1pub. 2021-11-17upd. 2024-11-21

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Canonical Accountsservice

    APP
    Canonical
    0.6.55-0ubuntu12\~20.04 – 0.6.55-0ubuntu12\~20.05 (excl.)0.6.55-0ubuntu13 – 0.6.55-0ubuntu13.3 (excl.)0.6.55-0ubuntu14 – 0.6.55-0ubuntu14.1 (excl.)

  • Canonical Ubuntu

    OS
    Canonical
    20.0421.0421.10
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2022-0543CRITICAL10.0⚠ KEVPL ✓same product

Redis – ucieczka z Lua sandbox umożliwiająca zdalne wykonanie kodu (RCE)

CVE-2020-11651CRITICAL9.8⚠ KEVPL ✓same product

SaltStack Salt: nieautoryzowany dostęp do metod salt-master umożliwiający RCE

CVE-2020-7247CRITICAL9.8⚠ KEVPL ✓same product

RCE jako root w OpenSMTPD przez command injection w polu MAIL FROM

CVE-2019-16928CRITICAL9.8⚠ KEVPL ✓same product

RCE w Exim — heap-based buffer overflow w obsłudze komendy EHLO