CVE-2012-2737
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in...
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Exploit likelihood
What each source reports
NVD Score used
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
- Record
CVE-2012-2737- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
- Record
CVE-2012-2737- Updated
- 2026-11-02
EUVDEUVD-2012-2717 No score
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
- Record
EUVD-2012-2717- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-26ch-x2j2-w6vx No score
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in...
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
- Record
GHSA-26ch-x2j2-w6vx- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
- Record
CVE-2012-2737- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2737 No score
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
- Record
DEBIAN-CVE-2012-2737- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10244-1 No score
accountsservice-0.6.43-1.1 on GA media
These are all security issues fixed in the accountsservice-0.6.43-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10244-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
accountsserviceDebian:12 |
before 0.6.21-6 | 0.6.21-6 |
accountsserviceDebian:13 |
before 0.6.21-6 | 0.6.21-6 |
accountsserviceDebian:14 |
before 0.6.21-6 | 0.6.21-6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2737 is a low vulnerability (CVSS 1.9) in Ray Stode Accountsservice, published July 22, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in accountsservice 0.6.21-6.
References
securityfocus.com/bid/54223
cgit.freedesktop.org/accountsservice/commit?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721
secunia.com/advisories/49695
ubuntu.com/usn/USN-1485-1
bugzilla.redhat.com/show_bug.cgi?id=832532
Show 12 moreShow less
osvdb.org/83398
exchange.xforce.ibmcloud.com/vulnerabilities/76648
hermes.opensuse.org/messages/15100967
openwall.com/lists/oss-security/2012/06/28/9
lists.fedoraproject.org/pipermail/package-announce/2012-July/083359.html
nvd.nist.gov/vuln/detail/CVE-2012-2737
github.com/advisories/GHSA-26ch-x2j2-w6vx
security-tracker.debian.org/tracker/CVE-2012-2737
suse.com/security/cve/CVE-2012-2737