USN-8987-1: libuser vulnerabilities

Q: Who can exploit these issues?

Exploitation requires a local attacker. The issues involve changing user information through libuser.

Q: What is the potential impact?

An attacker may corrupt the passwd file or leave it in an inconsistent state, causing denial of service. The in-place passwd-file update issue may also allow privilege escalation.

Q: How can I determine whether a system may be affected?

Review systems using the Ubuntu libuser or libuser1 packages, particularly where local users can change user information. The affected behavior concerns updates to the GECOS field and in-place passwd-file modification.

Published Nov 3, 2026

Updated

It was discovered that libuser did not properly validate the GECOS field when changing user information. A local attacker could possibly use this issue to corrupt the passwd file, resulting in a denial of service. (CVE-2015-3245)

It was discovered that libuser modified the passwd file in place when updating user information. A local attacker could possibly use this issue to cause an inconsistent file state, resulting in a denial of service, or possibly escalate privileges. (CVE-2015-3246)

Affected Software

3 affected componentsFixes available

All of the following

ubuntu/libuser1<1:0.60~dfsg-1.2ubuntu0.1~esm1

1:0.60~dfsg-1.2ubuntu0.1~esm1

Ubuntu Ubuntu=16.04

ubuntu/libuser<1:0.60~dfsg-1.2ubuntu0.1~esm1

1:0.60~dfsg-1.2ubuntu0.1~esm1

Event History

Nov 3, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·05:36 PM

Data Sourced

via OSV·05:36 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who can exploit these issues?

Exploitation requires a local attacker. The issues involve changing user information through libuser.

What is the potential impact?

An attacker may corrupt the passwd file or leave it in an inconsistent state, causing denial of service. The in-place passwd-file update issue may also allow privilege escalation.

How can I determine whether a system may be affected?

Review systems using the Ubuntu libuser or libuser1 packages, particularly where local users can change user information. The affected behavior concerns updates to the GECOS field and in-place passwd-file modification.

USN-8987-1: libuser vulnerabilities

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit these issues?

What is the potential impact?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit these issues?

What is the potential impact?

How can I determine whether a system may be affected?