Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.

NVD reports :

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4616-1 advisory.

  - Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient     path check in user_change_icon_file_authorized_cb() in user.c. (CVE-2018-14036)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the accountsservice packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Directory Traversal with ../ sequences occurs in     AccountsService before 0.6.50 because of an     insufficient path check in     user_change_icon_file_authorized_cb() in     user.c.(CVE-2018-14036)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for accountsservice fixes the following issues :

Security issue fixed :

CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699).

Non-security issue fixed: Improved wtmp io performance (bsc#1139487).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for accountsservice fixes the following issues :

This security issue was fixed :

  - CVE-2018-14036: Prevent directory traversal caused by an     insufficient path check in     user_change_icon_file_authorized_cb() (bsc#1099699)

Thsese non-security issues were fixed :

  - Don't abort loading users when an /etc/shadow entry is     missing. (bsc#1090003)

  - When user session type is wayland, act_user_is_logged_in     can return TRUE if the user is logged in. (bsc#1095918)

This update was imported from the SUSE:SLE-15:Update update project.

This update for accountsservice fixes the following issues :

This security issue was fixed :

CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699)

Thsese non-security issues were fixed: Don't abort loading users when an /etc/shadow entry is missing. (bsc#1090003)

When user session type is wayland, act_user_is_logged_in can return TRUE if the user is logged in. (bsc#1095918)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3140 advisory.

  - freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c leading to crash     (CVE-2015-9381)

  - freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment,     psaux/psobjs.c, leads to a buffer over-read (CVE-2015-9382)

  - gdk-pixbuf2: Heap overflow in the gdk_pixbuf__jpeg_image_load_increment function (CVE-2017-2862)

  - poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service     (CVE-2017-18267)

  - webkitgtk: memory corruption processing maliciously crafted web content (CVE-2018-4121, CVE-2018-4200,     CVE-2018-4204)

  - libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

  - libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

  - poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via     crafted PDF (CVE-2018-10768)

  - webkitgtk: Improper TLS certificate verification for WebSocket connections (CVE-2018-11712)

  - webkitgtk: WebSockets don't use system proxy settings (CVE-2018-11713)

  - libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

  - poppler: out of bounds read in pdfunite (CVE-2018-13988)

  - accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c     (CVE-2018-14036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
148703	FreeBSD : AccountService -- Insufficient path check in user_change_icon_file_authorized_cb() (75aae50b-9e3c-11eb-9bc3-8c164582fbac)	Nessus	FreeBSD Local Security Checks	medium
142371	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : AccountsService vulnerabilities (USN-4616-1)	Nessus	Ubuntu Local Security Checks	medium
132376	EulerOS 2.0 SP5 : accountsservice (EulerOS-SA-2019-2709)	Nessus	Huawei Local Security Checks	medium
132272	EulerOS 2.0 SP3 : accountsservice (EulerOS-SA-2019-2555)	Nessus	Huawei Local Security Checks	medium
131597	EulerOS 2.0 SP2 : accountsservice (EulerOS-SA-2019-2443)	Nessus	Huawei Local Security Checks	medium
130256	SUSE SLED12 / SLES12 Security Update : accountsservice (SUSE-SU-2019:2778-1)	Nessus	SuSE Local Security Checks	medium
123368	openSUSE Security Update : accountsservice (openSUSE-2019-902)	Nessus	SuSE Local Security Checks	medium
120155	SUSE SLED15 / SLES15 Security Update : accountsservice (SUSE-SU-2018:3625-1)	Nessus	SuSE Local Security Checks	medium
118877	openSUSE Security Update : accountsservice (openSUSE-2018-1380)	Nessus	SuSE Local Security Checks	medium
118726	RHEL 7 : GNOME (RHSA-2018:3140)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2018-14036

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical