Bug#903828: accountsservice: CVE-2018-14036: insufficient path check in user_change_icon_file_authorized_cb() in user.c
carnil at debian.org
Sun Jul 15 13:55:15 BST 2018
Tags: patch security upstream
Control: found -1 0.6.45-1
The following vulnerability was published for accountsservice.
| Directory Traversal with ../ sequences occurs in AccountsService before
| 0.6.50 because of an insufficient path check in
| user_change_icon_file_authorized_cb() in user.c.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
Please adjust the affected versions in the BTS as needed.
More information about the Pkg-freedesktop-maintainers