CVE-2012-2737
- State
- Published
- Severity
- Not scored
- Published
- Jul 22, 2012
- Updated
- Aug 6, 2024
- Reserved
- May 14, 2012
Description
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 54223vdb-entry
- http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721
- 49695third-party-advisory
- USN-1485-1vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=832532
- 49759third-party-advisory
- 83398vdb-entry
- accountsservice-userchangeicon-info-disc(76648)vdb-entry
- openSUSE-SU-2012:0845vendor-advisory
- http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5
- http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69
- [oss-security] 20120628 accountsservice local file disclosure flaw (CVE-2012-2737)mailing-list
- FEDORA-2012-10120vendor-advisory
- http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.