==========================================================================
Ubuntu Security Notice USN-4616-2
November 04, 2020
accountsservice vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 ESM
Summary:
Several security issues were fixed in AccountsService.
Software Description:
– accountsservice: query and manipulate user account information
Details:
USN-4616-1 fixed several vulnerabilities in AccountsService. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Kevin Backhouse discovered that AccountsService incorrectly dropped
privileges. A local user could possibly use this issue to cause
AccountsService to crash or hang, resulting in a denial of service.
(CVE-2020-16126)
Matthias Gerstner discovered that AccountsService incorrectly handled
certain path checks. A local attacker could possibly use this issue to
read arbitrary files. (CVE-2018-14036)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 ESM:
accountsservice 0.6.35-0ubuntu7.3+esm2
libaccountsservice0 0.6.35-0ubuntu7.3+esm2
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/4616-2
https://usn.ubuntu.com/4616-1
CVE-2018-14036, CVE-2020-16126
—–BEGIN PGP SIGNATURE—–
iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAl+ir9YACgkQRbznW4QL
H2kvWg/+L8Zwq1cWHdWT8sJpzOt8337uR1OYNtomSjfCWE0TTMqGdjRFqtOb81x6
TiqOsSh0FYvkMoMjW2OwYda9upZWh/dHo3xbzIVCZV9Nx6mqwyv/g/w6MV6cN7Do
oAEl1kmai55zbpKpvh9co+4Dmsm0nd7c8nOxi7f30wXTp2qgoygdayukf0dYIIGx
nKSIj7Be1MgimP8zjBt9yFMj1aM2UbPXIK+2cOUoN0vksXWRcZ64GYYx3N9HI7JI
7vZ+ZIH/swIe4yym0bh7/FJ3H7YexosE9t3fP6qKAw8TNtJwVjZMu8nY4ZEdSmXM
viLSAEqXQJ62w15yQmhpItAfBfTHAepbW0TyXqLnE7piSHQ1xl5TwYKlpASDYDi3
dLAeHWDHUdPTvIYtpVgk7vSJl8/joqdrybOWhvrb1OhYFcYKfVoXyWpB1+yFcH07
f92y4ozB3oQ4e5BEmM1PqETWqH6i+6bsD3S0qPK2/pokftDdrksaLFKNADwxmw8o
WvZkANRB2mKhvwp1ye+uE8W5uXP7KJLL9n4+wgjwqpoNuTSvRcuPS4ut5bhiM/1d
dwK8GGU8TNWTYHZHggtoOMMiq5xx6ooTY9OxjmOZNenrv5gT5VEoZsO+zOy7Or0m
gAVWoM442pI/2ZgKKES2tmJ6eVlE4cYp+mmL+2vY9tKh6nSZVkI=
=HQWT
—–END PGP SIGNATURE—–
—
