CVE-2011-4406

The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges...

3.6 LowFix available

The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.

Exploit likelihood

0.38%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

Record: CVE-2011-4406
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-4406
Updated: 2026-11-02

EUVDEUVD-2011-4335 No score

Record: EUVD-2011-4335
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hg97-5vhj-mp5w No score

The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges...

Record: GHSA-hg97-5vhj-mp5w
Updated: 2026-11-02

OSV No score

Record: CVE-2011-4406
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-4406 No score

Record: DEBIAN-CVE-2011-4406
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`accountsservice` Debian:12	before 0.6.15-3	0.6.15-3
`accountsservice` Debian:13	before 0.6.15-3	0.6.15-3
`accountsservice` Debian:14	before 0.6.15-3	0.6.15-3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4406 is a low vulnerability (CVSS 3.6) in Canonical Accountsservice, published April 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in accountsservice 0.6.15-3.