CVE-2023-3297

Summary

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Affected Software

Weaknesses

• CWE-416: CWE-416

ADP Enrichment

CVE Program Container

Additional References

• https://ubuntu.com/security/notices/USN-6190-1
• https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/
• https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

References

• https://ubuntu.com/security/notices/USN-6190-1
• https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/
• https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297

• ←Previous
• Next→