Unrated severityNVD Advisory· Published Nov 17, 2021· Updated Sep 16, 2024

Free of static data in accountsservice

CVE-2021-3939

Description

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Canonical/Accountsservicellm-fuzzy
Range: <0.6.55-0ubuntu12~20.04.5
Ubuntu/accountsservicev5
Range: 0.6.55-0ubuntu12~20.04

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/172848/Ubuntu-accountsservice-Double-Free-Memory-Corruption.htmlmitre
bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1950149mitre
ubuntu.com/security/notices/USN-5149-1mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000