The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2012-07-22T17:00:00

Updated: 2024-08-06T19:42:32.438Z

Reserved: 2012-05-14T00:00:00

Link: CVE-2012-2737

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2012-07-22T17:55:02.913

Modified: 2024-11-21T01:39:32.353

Link: CVE-2012-2737

cve-icon Redhat

No data.