VDB
CVE-2012-2737
CVE-2012-2737
PUBLISHED
Reported by redhat · Published July 22, 2012
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | * |
Timeline
- Jul 22, 2012 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 30, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Jun 1, 2023 EPSS Score
References
- 54223 vdb-entryx_refsource_BID
- x_refsource_CONFIRM
- 49695 third-party-advisoryx_refsource_SECUNIA
- USN-1485-1 vendor-advisoryx_refsource_UBUNTU
- x_refsource_MISC
- 49759 third-party-advisoryx_refsource_SECUNIA
- 83398 vdb-entryx_refsource_OSVDB
- accountsservice-userchangeicon-info-disc(76648) vdb-entryx_refsource_XF
- openSUSE-SU-2012:0845 vendor-advisoryx_refsource_SUSE
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- [oss-security] 20120628 accountsservice local file disclosure flaw (CVE-2012-2737) mailing-listx_refsource_MLIST
- FEDORA-2012-10120 vendor-advisoryx_refsource_FEDORA
- x_refsource_CONFIRM