Bug#903828: accountsservice: CVE-2018-14036: insufficient path check in user_change_icon_file_authorized_cb() in user.c
jmm at inutil.org
Fri Jan 4 22:18:28 GMT 2019
On Sun, Jul 15, 2018 at 02:55:15PM +0200, Salvatore Bonaccorso wrote:
> Source: accountsservice
> Version: 0.6.43-1
> Severity: important
> Tags: patch security upstream
> Forwarded: https://bugs.freedesktop.org/show_bug.cgi?id=107085
> Control: found -1 0.6.45-1
> The following vulnerability was published for accountsservice.
> | Directory Traversal with ../ sequences occurs in AccountsService before
> | 0.6.50 because of an insufficient path check in
> | user_change_icon_file_authorized_cb() in user.c.
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> For further information see:
>  https://security-tracker.debian.org/tracker/CVE-2018-14036
>  https://bugs.freedesktop.org/show_bug.cgi?id=107085
>  http://www.openwall.com/lists/oss-security/2018/07/02/2
>  https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a
Can you please fix this before the buster freeze?
More information about the Pkg-freedesktop-maintainers