Bug#903828: accountsservice: CVE-2018-14036: insufficient path check in user_change_icon_file_authorized_cb() in user.c

[Moritz Mühlenhoff]

On Sun, Jul 15, 2018 at 02:55:15PM +0200, Salvatore Bonaccorso wrote:
> Source: accountsservice
> Version: 0.6.43-1
> Severity: important
> Tags: patch security upstream
> Forwarded: https://bugs.freedesktop.org/show_bug.cgi?id=107085
> Control: found -1  0.6.45-1
> 
> Hi,
> 
> The following vulnerability was published for accountsservice.
> 
> CVE-2018-14036[0]:
> | Directory Traversal with ../ sequences occurs in AccountsService before
> | 0.6.50 because of an insufficient path check in
> | user_change_icon_file_authorized_cb() in user.c.
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2018-14036
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14036
> [1] https://bugs.freedesktop.org/show_bug.cgi?id=107085
> [2] http://www.openwall.com/lists/oss-security/2018/07/02/2
> [3] https://cgit.freedesktop.org/accountsservice/commit/?id=f9abd359f71a5bce421b9ae23432f539a067847a

Can you please fix this before the buster freeze?

Cheers,
        Moritz