Vulnerability Details CVE-2023-3297
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 17.5%
CVSS Severity
CVSS v3 Score 8.1
References
- https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297
- https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/
- https://ubuntu.com/security/notices/USN-6190-1
- https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297
- https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/
- https://ubuntu.com/security/notices/USN-6190-1
Products affected by CVE-2023-3297
-
cpe:2.3:a:canonical:accountsservice:0.6.14
-
cpe:2.3:a:canonical:accountsservice:0.6.55-0ubuntu12~20.04
-
cpe:2.3:a:canonical:accountsservice:0.6.55-0ubuntu12~20.04.6
-
cpe:2.3:a:canonical:accountsservice:0.6.55-0ubuntu12~20.05
-
cpe:2.3:a:canonical:accountsservice:0.6.55-0ubuntu13
-
cpe:2.3:a:canonical:accountsservice:0.6.55-0ubuntu13.3
-
cpe:2.3:a:canonical:accountsservice:0.6.55-0ubuntu14
-
cpe:2.3:a:canonical:accountsservice:0.6.55-0ubuntu14.1
-
cpe:2.3:a:canonical:accountsservice:22.07.5-2ubuntu1.4
-
cpe:2.3:a:canonical:accountsservice:22.08.8-1ubuntu7.1
-
cpe:2.3:o:canonical:ubuntu_linux:20.04
-
cpe:2.3:o:canonical:ubuntu_linux:22.04
-
cpe:2.3:o:canonical:ubuntu_linux:22.10
-
cpe:2.3:o:canonical:ubuntu_linux:23.04
-
cpe:2.3:o:linux:linux_kernel:-