Skip to main content

Ubuntu CVE-2021-3939

HIGH
Free of Memory not on the Heap (CWE-590)
2021-11-17 security@ubuntu.com
Debian Ubuntu Information Disclosure Accountsservice Ubuntu Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 17, 2021 - 04:15 nvd
HIGH 7.8

DescriptionNVD

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

AnalysisAI

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-590. Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1. Affected products include: Canonical Accountsservice, Canonical Ubuntu Linux.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Accountsservice

View all
CVE-2023-3297 HIGH POC
7.8 Sep 01

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice
CVE-2018-14036 MEDIUM POC
6.5 Jul 13

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in

CVE-2020-16127 MEDIUM POC
5.5 Nov 11

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions,

CVE-2020-16126 LOW POC
3.3 Nov 11

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions,

CVE-2012-2737 LOW POC
1.9 Jul 22

The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does n
CVE-2022-1804 MEDIUM
5.5 Mar 25

accountsservice no longer drops permissions when writting .pam_environment. Rated medium severity (CVSS 5.5), this vulne

Same weakness CWE-590 – Free of Memory not on the Heap

View all
CVE-2022-31627 CRITICAL POC
9.8
CVE-2020-6016 CRITICAL POC
9.8
CVE-2022-31625 HIGH POC
8.1
CVE-2023-22291 HIGH POC
7.8
CVE-2021-42377 CRITICAL
9.8
CVE-2025-32911 CRITICAL
9.0
CVE-2026-20810 HIGH
7.8
CVE-2025-42995 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-3939 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy