https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T17:57:39.862681+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-61897 fkie_cve-2026-61897 2026-09-29T17:57:39.893967+00:00

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

 https://vulnerability.circl.lu/vuln/ghsa-8h74-384h-cv6c GHSA-8h74-384h-cv6c 2026-09-29T17:57:39.894070+00:00

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-61897 UBUNTU-CVE-2026-61897 2026-09-29T17:57:39.894109+00:00

Affected: Ubuntu:Pro:14.04:LTS: accountsservice, Ubuntu:Pro:16.04:LTS: accountsservice, Ubuntu:Pro:18.04:LTS: accountsservice, Ubuntu:Pro:20.04:LTS: accountsservice, Ubuntu:22.04:LTS: accountsservice, Ubuntu:24.04:LTS: accountsservice, Ubuntu:26.04:LTS: accountsservice

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.