Launchpad.net

Launchpad Home
Code
Bugs
Blueprints
Translations
Answers

CVE 2023-3297

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Related bugs and status

CVE-2023-3297 (Candidate) is related to these bugs:

Bug #2024182: GHSL-2023-139: use-after-free in user.c

		In	Importance	Status
2024182	GHSL-2023-139: use-after-free in user.c	accountsservice (Ubuntu)	Medium	Fix Released
2024182	GHSL-2023-139: use-after-free in user.c	accountsservice (Ubuntu Mantic)	Medium	Fix Released
2024182	GHSL-2023-139: use-after-free in user.c	accountsservice (Ubuntu Lunar)	Medium	Fix Released
2024182	GHSL-2023-139: use-after-free in user.c	accountsservice (Ubuntu Jammy)	Medium	Fix Released
2024182	GHSL-2023-139: use-after-free in user.c	accountsservice (Ubuntu Focal)	Medium	Fix Released
2024182	GHSL-2023-139: use-after-free in user.c	accountsservice (Ubuntu Kinetic)	Medium	Fix Released

See the

CVE page on Mitre.org for more details.

References

MISC: https://bugs.launchpad...
MISC: https://cve.mitre.org/...
MISC: https://securitylab.gi...
MISC: https://ubuntu.com/sec...