CVE-2020-16127: accountsservice .pam_environment infinite loop
First published: Wed Nov 11 2020(Updated: )
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.
Credit: security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Freedesktop Accountsservice | <0.6.55 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-16127.
What is the severity of CVE-2020-16127?
CVE-2020-16127 has a severity keyword of 'medium' and a severity value of 5.5.
What software is affected by CVE-2020-16127?
The affected software is Freedesktop Accountsservice versions before 0.6.55-0ubuntu13.2.
How can the vulnerability CVE-2020-16127 be exploited?
The vulnerability can be exploited by creating a symlink to /dev/zero in the user-controlled ~/.pam_environment file, causing the program to enter an infinite loop.
Is there a fix for CVE-2020-16127?
Yes, the fix for CVE-2020-16127 is available in version 0.6.55-0ubuntu13.2 of Accountsservice.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/title
- agent/severity
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/freedesktop
- canonical/freedesktop accountsservice