Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2018/07/02/2 | Exploit Mailing List Third Party Advisory |
http://www.securityfocus.com/bid/104757 | Third Party Advisory VDB Entry |
https://bugs.freedesktop.org/show_bug.cgi?id=107085 | Exploit Third Party Advisory |
https://bugzilla.suse.com/show_bug.cgi?id=1099699 | Exploit Issue Tracking Third Party Advisory |
https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a | Patch Third Party Advisory |
Configurations
History
No history.
Information
Published : 2018-07-13 12:29
Updated : 2024-02-28 16:48
NVD link : CVE-2018-14036
Mitre link : CVE-2018-14036
CVE.ORG link : CVE-2018-14036
JSON object : View
Products Affected
freedesktop
- accountsservice
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')