Vulnerability Report

CVE-2012-2737

Title: Ray Stode Accountsservice Path Traversal / LFI

Arbitrary File Access

Proof Of Concept

No public PoC currently indexed for CVE-2012-2737.

CWE Category CWE-362

Published Date Jul 22, 2012

Modified Date Jun 16, 2026

Exploit Status Not Found

Score 1.9 CVSS v2.0

Exploit Probability (EPSS)

0.36%

Vulnerability Summary

CVE-2012-2737: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.

Impacted Vendors

ray_stode 1

accountsservice_project 1

Reference Links

http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5 http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69 http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721 http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083359.html http://osvdb.org/83398 http://secunia.com/advisories/49695 http://secunia.com/advisories/49759 http://www.openwall.com/lists/oss-security/2012/06/28/9 http://www.securityfocus.com/bid/54223 http://www.ubuntu.com/usn/USN-1485-1 https://bugzilla.redhat.com/show_bug.cgi?id=832532 https://exchange.xforce.ibmcloud.com/vulnerabilities/76648 https://hermes.opensuse.org/messages/15100967 http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5 http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69 http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721 http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083359.html http://osvdb.org/83398 http://secunia.com/advisories/49695 http://secunia.com/advisories/49759 http://www.openwall.com/lists/oss-security/2012/06/28/9 http://www.securityfocus.com/bid/54223 http://www.ubuntu.com/usn/USN-1485-1 https://bugzilla.redhat.com/show_bug.cgi?id=832532 https://exchange.xforce.ibmcloud.com/vulnerabilities/76648 https://hermes.opensuse.org/messages/15100967

CVSS v2.0

Source Entity [email protected]

Severity LOW

1.9

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:M/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2012-2737 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 29, 2026 MODIFIED

Vulnerability data updated via NVD.

April 11, 2025 MODIFIED

Vulnerability data or affected products updated.

July 22, 2012 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:L/AC:M/Au:N/C:P/I:N/A:N

Affected Stack

No specific products linked.