PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2018-14036

CVE-2018-14036

accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c

Loading…

Severity

Moderate

Red Hat Product Security

5

CVSS 3.0

Review impact separately from score.

Published · July 13, 2018

Updated · June 27, 2026

Description

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 5
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')