Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2021-3939

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

  • Published: Nov 17, 2021
  • Updated: Apr 14, 2023
  • CVE: CVE-2021-3939
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.8
  • AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.2
  • AV:L/AC:L/Au:N/C:C/I:C/A:C

CWEs:

Software From Fixed in
canonical / accountsservice 0.6.55-0ubuntu12\~20.04 0.6.55-0ubuntu12\~20.05
canonical / accountsservice 0.6.55-0ubuntu13 0.6.55-0ubuntu13.3
canonical / accountsservice 0.6.55-0ubuntu14 0.6.55-0ubuntu14.1
canonical / ubuntu_linux 20.04 20.04.x
canonical / ubuntu_linux 21.04 21.04.x
canonical / ubuntu_linux 21.10 21.10.x