CVEvulnerability

CVE-2012-2737

1.9 LOW Published 2012-07-22 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-07-22
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
1.9 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-362

Description

The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.

Affected configurations

• ray stode accountsservice (<= 0.6.21) • ray stode accountsservice 0.4 • ray stode accountsservice 0.5 • ray stode accountsservice 0.6 • ray stode accountsservice 0.6.1 • ray stode accountsservice 0.6.2 • ray stode accountsservice 0.6.3 • ray stode accountsservice 0.6.4 • ray stode accountsservice 0.6.5 • ray stode accountsservice 0.6.6 • ray stode accountsservice 0.6.7 • ray stode accountsservice 0.6.8 • ray stode accountsservice 0.6.9 • ray stode accountsservice 0.6.10 • ray stode accountsservice 0.6.11 • ray stode accountsservice 0.6.12 • ray stode accountsservice 0.6.13 • ray stode accountsservice 0.6.14 • ray stode accountsservice 0.6.15 • ray stode accountsservice 0.6.16 • ray stode accountsservice 0.6.17 • ray stode accountsservice 0.6.18 • ray stode accountsservice 0.6.19 • ray stode accountsservice 0.6.20

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References