CVE-2021-3939CWE-590

Free of static data in accountsservice

High · published November 17, 2021

CVSS v3.1
7.8
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.8th percentile
Weakness
CWE-590 · Free of Memory not on the Heap
Published
2021-11-17T03:15Z
EPSS history
Timeline
  • 17 NOV 03:15Z
    Free of static data in accountsservice
    cvelistv5