Ubuntu alert USN-8580-2 (accountsservice)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8580-2] AccountsService vulnerabilities
Date:
             
 
Tue, 21 Jul 2026 21:33:17 +0000
Message-ID:
             
 
<E1wmI5V-0001Qi-Mc@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8580-2
July 21, 2026

accountsservice vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

AccountsService could be made to run programs as an administrator if it
opened a specially crafted file.

Software Description:
- accountsservice: query and manipulate user account information

Details:

USN-8580-1 fixed vulnerabilities in AccountsService. This update provides
the corresponding fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.

Original advisory details:

 It was discovered that the Ubuntu-specific SetLanguage patch to
 AccountsService incorrectly handled dropping privileges. A local attacker
 could use this issue to execute arbitrary commands as an administrator.
 (CVE-2026-61897)

 It was discovered that the Ubuntu-specific SetLanguage helpers for
 AccountsService incorrectly handled parsing configuration files. A local
 attacker could use this issue to execute arbitrary commands.
 (CVE-2026-61898)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  accountsservice                 0.6.55-0ubuntu12~20.04.7+esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  accountsservice                 0.6.45-1ubuntu1.3+esm2
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  accountsservice                 0.6.40-2ubuntu11.6+esm2
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  accountsservice                 0.6.35-0ubuntu7.3+esm4
                                  Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8580-2
  https://ubuntu.com/security/notices/USN-8580-1
  CVE-2026-61897, CVE-2026-61898


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpf5R8ACgkQcpJm3tlz
hgGjRA//Vj6nEOGA0c+HscgohEp4I50k+FUjT2XUGaND4cQ9V2m9UUpODfsDWOdl
5ODtG+XZArrK4gaJcFb3mU0M0WguMB1E+UppfzrwxX3NCuqLBhCA/5SoiorrVnBB
AujUyBNiQsVU4/ZjmB5XojuyHPYk+zW8lOKURaVe+TFy/CPpJ7ZKNzgrXh6q7r0r
iYnWmGzUCkfG+xztGjGfJvC73xjAOzjgQq09DjCl5ovz+bd+sAz8Ji/77hwjOiuq
BwtNOguYeLC1lHeag+Xdxzto7u5soYPQJx0VYOwFjl/wGzWFM55Rv6ojKvo9GkVk
L6Dx4Kuqr30BpEuY5kYQEcb45fvnm4ZyF/45gPq9g6geg7G14N6aWozVV1datkAd
7HoqmBmdAk1/c19TqNi8jnb0JadgERJeRy9c97AE1oxt1Uzvcr68L/BPvskGR8PK
eF8wh2O6YD6FrpEXPc6o8gnv6qYfz52Nv8qWX1QOPiYmAZMh7RNnE0OQk3pbUYbu
/LWjGqxtukN8W3oDdxd9VW3HC15Vj0mqNMIyyutlC2uugGfCX+GumOFgyYgElPOO
bPCjx0Y+hT5EMvwapDOre8xLQeJgmIIvWZ8L3uFHFOsasPXHr+UeGofNV/4Q/pBY
iJG7EVEcIEFSS3nLbMnSTvu5jmXlB3sQBdUEDIS8xXbJbQ9bA+c=
=3iuD
-----END PGP SIGNATURE-----