Ubuntu alert USN-8580-1 (accountsservice)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8580-1] AccountsService vulnerabilities
Date:
             
 
Tue, 21 Jul 2026 18:13:51 +0000
Message-ID:
             
 
<E1wmEyV-0005tj-1F@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8580-1
July 21, 2026

accountsservice vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

AccountsService could be made to run programs as an administrator if it
opened a specially crafted file.

Software Description:
- accountsservice: query and manipulate user account information

Details:

It was discovered that the Ubuntu-specific SetLanguage patch to
AccountsService incorrectly handled dropping privileges. A local attacker
could use this issue to execute arbitrary commands as an administrator.
(CVE-2026-61897)

It was discovered that the Ubuntu-specific SetLanguage helpers for
AccountsService incorrectly handled parsing configuration files. A local
attacker could use this issue to execute arbitrary commands.
(CVE-2026-61898)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  accountsservice                 23.13.9-8ubuntu5.2
  libaccountsservice0             23.13.9-8ubuntu5.2

Ubuntu 24.04 LTS
  accountsservice                 23.13.9-2ubuntu6.1
  libaccountsservice0             23.13.9-2ubuntu6.1

Ubuntu 22.04 LTS
  accountsservice                 22.07.5-2ubuntu1.6
  libaccountsservice0             22.07.5-2ubuntu1.6

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8580-1
  CVE-2026-61897, CVE-2026-61898

Package Information:
  https://launchpad.net/ubuntu/+source/accountsservice/23.1...
  https://launchpad.net/ubuntu/+source/accountsservice/23.1...
  https://launchpad.net/ubuntu/+source/accountsservice/22.0...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpftVUACgkQcpJm3tlz
hgEOyg//YGAXGz88EK6tgZHXU+o8Dn/mSkIqnclK9Az6a3mWRH26JIjQLuMh/Q9y
WzPOynpZkSUw/+/5PDmtnvEXLoNIToVS1o7K93omXwaSZ89CehFyhAIU4ZY3Y7uD
oYPj7QxQ02XW8ySSiEv9CQhOMPWSCmWbLEuzgMU7skJvPwcCmzrAnOdEpe/UzxFR
+PKS+fn9ThoTfUq+MJookwqOyztptT+uOPld08OCEcJx54W4283lVZ6d6mUV2948
twT9BDpySW4aYCb8Lf7Kebol1vV3hNpcNYgc4IBLorWYFoD6K+Vct3Bg/j7mAZME
Z9oMwHKtDwSsDUappu4lEe7l/ZUw03Y0MEbK4wv//pNPlOuAbF3hauOKmSuXu6w1
67gJNu9EOVegdkALG1D+KjwfCCliItPOOtzdw1mmcNeTT/JXjpDb18FFd7YSU+ef
BspoXqOCvnfqQJlUre9SSEvz0mDKnvFDTrfNCAB0IJ4r1VI87oQRlfZ5Sz+RX/ii
sDJsJCky8ANfFrhlm70hYGcfI5ox8k3pcy6cP0ZplVwYRw2f8ZZxmUBn/YA/SxQJ
r+PZPiP/u8ZKlSmz0MxAc3hoMRgU1/TRMb/bYBLJmhtAzuC6A4M0fd9ezhRnLfsP
qrQ3ilZ6rBEdG3Dn90iiGsCS8t4Tknjc5CTlGntKti01H4MkuFA=
=DnDg
-----END PGP SIGNATURE-----