This bug was fixed in the package accountsservice - 23.13.9-8ubuntu7
---------------
accountsservice (23.13.9-8ubuntu7) stonking; urgency=medium
* SECURITY UPDATE: SetLanguage leads to local privilege escalation and
root code execution (LP: #2157985)
- debian/patches/0010-set-language.patch:
Fully drop privileges when running locale helpers in src/user.c,
src/util.c, src/util.h.
- debian/patches/0009-language-tools.patch:
Handle input as untrusted in data/langtools/save-to-pam-env,
data/langtools/set-language-helper, data/langtools/update-langlist.
- CVE-2026-61897
- CVE-2026-61898
-- Alessandro Astone <[email protected]> Wed, 22 Jul
2026 09:37:32 +0200
** Changed in: accountsservice (Ubuntu Stonking)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2157985
Title:
SetLanguage leads to local privilege escalation and thus allows root
code execution
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2157985/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
