USN-6190-2: AccountsService vulnerability
25 September 2023
AccountsService could be made to crash or run programs if it received specially crafted messages.
Releases
Packages
- accountsservice - query and manipulate user account information
Details
USN-6190-1 fixed a vulnerability in AccountsService. This update provides
the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS.
Original advisory details:
Kevin Backhouse discovered that AccountsService incorrectly handled certain
D-Bus messages. A local attacker could use this issue to cause
AccountsService to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
accountsservice
-
0.6.45-1ubuntu1.3+esm1
Available with Ubuntu Pro
-
libaccountsservice0
-
0.6.45-1ubuntu1.3+esm1
Available with Ubuntu Pro
Ubuntu 16.04
-
accountsservice
-
0.6.40-2ubuntu11.6+esm1
Available with Ubuntu Pro
-
libaccountsservice0
-
0.6.40-2ubuntu11.6+esm1
Available with Ubuntu Pro
Ubuntu 14.04
-
accountsservice
-
0.6.35-0ubuntu7.3+esm3
Available with Ubuntu Pro
-
libaccountsservice0
-
0.6.35-0ubuntu7.3+esm3
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make all
the necessary changes.
References
Related notices
- USN-6190-1: accountsservice, libaccountsservice-dev, libaccountsservice0, gir1.2-accountsservice-1.0, libaccountsservice-doc