CVE-2021-3939

Free of static data in accountsservice

State: Published
Severity: 7.8 High
Published: Nov 17, 2021
Updated: Sep 16, 2024
Reserved: Nov 9, 2021

Description

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H	canonical

Weaknesses

CWE-590 Free of Memory not on the Heap

Affected Products

Product	Versions
accountsserviceUbuntu	0.6.55-0ubuntu12~20.04 to before 0.6.55-0ubuntu12~20.04.5Affected 0.6.55-0ubuntu13 to before 0.6.55-0ubuntu13.3Affected 0.6.55-0ubuntu14 to before 0.6.55-0ubuntu14.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.