Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2018/07/02/2 | Exploit Mailing List Third Party Advisory |
http://www.securityfocus.com/bid/104757 | Third Party Advisory VDB Entry |
https://bugs.freedesktop.org/show_bug.cgi?id=107085 | Exploit Third Party Advisory |
https://bugzilla.suse.com/show_bug.cgi?id=1099699 | Exploit Issue Tracking Third Party Advisory |
https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a | Patch Third Party Advisory |
http://www.openwall.com/lists/oss-security/2018/07/02/2 | Exploit Mailing List Third Party Advisory |
http://www.securityfocus.com/bid/104757 | Third Party Advisory VDB Entry |
https://bugs.freedesktop.org/show_bug.cgi?id=107085 | Exploit Third Party Advisory |
https://bugzilla.suse.com/show_bug.cgi?id=1099699 | Exploit Issue Tracking Third Party Advisory |
https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a | Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 03:48
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.openwall.com/lists/oss-security/2018/07/02/2 - Exploit, Mailing List, Third Party Advisory | |
References | () http://www.securityfocus.com/bid/104757 - Third Party Advisory, VDB Entry | |
References | () https://bugs.freedesktop.org/show_bug.cgi?id=107085 - Exploit, Third Party Advisory | |
References | () https://bugzilla.suse.com/show_bug.cgi?id=1099699 - Exploit, Issue Tracking, Third Party Advisory | |
References | () https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a - Patch, Third Party Advisory |
Information
Published : 2018-07-13 12:29
Updated : 2024-11-21 03:48
NVD link : CVE-2018-14036
Mitre link : CVE-2018-14036
CVE.ORG link : CVE-2018-14036
JSON object : View
Products Affected
freedesktop
- accountsservice
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')