Every CVE Search/ Get API key

CVE-2023-3297

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free...

8.1 HighFix available

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.33%Up 0.3 points since Sep 2, 2023
90%50%10%1%

What each source reports

CVE List Score used 8.1

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Record
CVE-2023-3297
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2023-43972 8.1

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Record
EUVD-2023-43972
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-gr7p-26mx-9pgw 8.1

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free...

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Record
GHSA-gr7p-26mx-9pgw
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 8.1

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Record
CVE-2023-3297
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVAZL-43453 7.8

CVE-2023-3297 affecting package accountsservice 0.6.55-4

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Record
AZL-43453
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-44259 7.8

CVE-2023-3297 affecting package accountsservice for versions less than 23.13.9-1

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Record
AZL-44259
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2023-3297 8.1

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Record
UBUNTU-CVE-2023-3297
CVSS 3.1
8.1 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1787732137 No score

Fix CVE(s): CVE-2023-3297

  • SECURITY UPDATE: use-after-free in user.c (LP: #2024182)
    • debian/patches/CVE-2023-3297.patch: return from user_change_language_authorized_cb() and user_change_formats_locale_authorized_cb() after throw_error() has consumed the D-Bus invocation, instead of falling through to accounts_user_complete_set_language()/set_formats_locale() and completing the freed invocation a second time.
    • CVE-2023-3297
Record
CLSA-2026-1787732137
Updated
2026-11-02
OSVUSN-6190-1 No score

accountsservice vulnerability

Kevin Backhouse discovered that AccountsService incorrectly handled certain D-Bus messages. A local attacker could use this issue to cause AccountsService to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-6190-1
Updated
2026-11-02
OSVUSN-6190-2 No score

accountsservice vulnerability

USN-6190-1 fixed a vulnerability in AccountsService. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

Kevin Backhouse discovered that AccountsService incorrectly handled certain D-Bus messages. A local attacker could use this issue to cause AccountsService to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-6190-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
accountsservice
Azure Linux:2
 through 0.6.55-4 None known
accountsservice
Azure Linux:3
 before 23.13.9-1
23.13.9-1
accountsservice
TuxCare:Ubuntu:18.04
 before 0.6.45-1ubuntu1.3+tuxcare.els1
0.6.45-1ubuntu1.3+tuxcare.els1
gir1.2-accountsservice-1.0
TuxCare:Ubuntu:18.04
 before 0.6.45-1ubuntu1.3+tuxcare.els1
0.6.45-1ubuntu1.3+tuxcare.els1
libaccountsservice-dev
TuxCare:Ubuntu:18.04
 before 0.6.45-1ubuntu1.3+tuxcare.els1
0.6.45-1ubuntu1.3+tuxcare.els1
libaccountsservice-doc
TuxCare:Ubuntu:18.04
 before 0.6.45-1ubuntu1.3+tuxcare.els1
0.6.45-1ubuntu1.3+tuxcare.els1
libaccountsservice0
TuxCare:Ubuntu:18.04
 before 0.6.45-1ubuntu1.3+tuxcare.els1
0.6.45-1ubuntu1.3+tuxcare.els1
accountsservice
Ubuntu:Pro:14.04:LTS
 before 0.6.35-0ubuntu7.3+esm3, plus listed versions
0.6.34-0ubuntu60.6.34-0ubuntu70.6.35-0ubuntu10.6.35-0ubuntu20.6.35-0ubuntu3
Show 8 moreShow less
0.6.35-0ubuntu40.6.35-0ubuntu50.6.35-0ubuntu60.6.35-0ubuntu70.6.35-0ubuntu7.10.6.35-0ubuntu7.20.6.35-0ubuntu7.30.6.35-0ubuntu7.3+esm2
0.6.35-0ubuntu7.3+esm3
accountsservice
Ubuntu:Pro:16.04:LTS
 before 0.6.40-2ubuntu11.6+esm1, plus listed versions
0.6.40-2ubuntu50.6.40-2ubuntu60.6.40-2ubuntu70.6.40-2ubuntu80.6.40-2ubuntu9
Show 6 moreShow less
0.6.40-2ubuntu100.6.40-2ubuntu110.6.40-2ubuntu11.10.6.40-2ubuntu11.20.6.40-2ubuntu11.30.6.40-2ubuntu11.6
0.6.40-2ubuntu11.6+esm1
accountsservice
Ubuntu:Pro:18.04:LTS
 before 0.6.45-1ubuntu1.3+esm1, plus listed versions
0.6.42-0ubuntu30.6.42-0ubuntu40.6.45-1ubuntu10.6.45-1ubuntu1.3
0.6.45-1ubuntu1.3+esm1
accountsservice
Ubuntu:20.04:LTS
 before 0.6.55-0ubuntu12~20.04.6, plus listed versions
0.6.55-0ubuntu100.6.55-0ubuntu110.6.55-0ubuntu12~20.04.10.6.55-0ubuntu12~20.04.20.6.55-0ubuntu12~20.04.40.6.55-0ubuntu12~20.04.5
0.6.55-0ubuntu12~20.04.6
accountsservice
Ubuntu:22.04:LTS
 before 22.07.5-2ubuntu1.4, plus listed versions
0.6.55-0ubuntu140.6.55-3ubuntu10.6.55-3ubuntu20.6.55-3ubuntu40.6.55-3ubuntu50.6.55-3ubuntu622.07.5-2ubuntu122.07.5-2ubuntu1.3
22.07.5-2ubuntu1.4

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-3297 is a high vulnerability (CVSS 8.1) in Canonical Accountsservice, published June 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in accountsservice 23.13.9-1.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open