NVD

Id
44451  
Name
CVE-2012-2737  
Description
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.  
Reject
 
CVSS Version
2  
CVSS Score
1.9  
Severity
Low  
CVSS Base Score
1.9  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-07-22  
Modified Date
2012-10-30  
Seq
2012-2737  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
223050 44451 CVE-2012-2737 http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5  View
223051 44451 CVE-2012-2737 http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69  View
223052 44451 CVE-2012-2737 http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d  View
223053 44451 CVE-2012-2737 http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721  View
223054 44451 CVE-2012-2737 FEDORA-2012-10120  View
223055 44451 CVE-2012-2737 [oss-security] 20120628 accountsservice local file disclosure flaw (CVE-2012-2737)  View
223056 44451 CVE-2012-2737 54223  View
223057 44451 CVE-2012-2737 USN-1485-1  View
223058 44451 CVE-2012-2737 accountsservice-userchangeicon-info-disc(76648)  View
223059 44451 CVE-2012-2737 https://bugzilla.redhat.com/show_bug.cgi?id=832532  View
223060 44451 CVE-2012-2737 openSUSE-SU-2012:0845  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27569 JVNDB-2012-003276 AccountsService の /usr/libexec/accounts-daemon における任意のファイルを読まれる脆弱性 AccountsService の /usr/libexec/accounts-daemon 内の user_change_icon_file_authorized_cb 関数は、アイコンファイルをシステムキャッシュディレクトリへコピーする際に、UID を適切に確認しないため、任意のファイルを読まれる脆弱性が存在します。 CVE-2012-2737 55975 CVE-2012-2737 44451 1.9 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003276.html 2012-06-19 2012-11-13 View