Zurück zu den Sicherheitshinweisen

Libuser Vulnerabilities — Ubuntu Security Update (USN-8987-1)

USN-8987-1 fixes two old libuser vulnerabilities on Ubuntu (CVE-2015-3245 and CVE-2015-3246): improper GECOS-field validation when changing user information could corrupt the passwd file (CWE-20), causing denial of service or account-manipulation issues. Update: sudo apt update && sudo apt upgrade libuser.

High 2.1 CVSS Aktiv ausgenutzt
Ubuntu 20.04 Ubuntu 22.04

Was das unter einer SharedLicense-Lizenz bedeutet

passwd-file corruption from the user-modification path can lock accounts out, break authentication, or be steered to manipulate account fields — a local denial-of-service and account-tampering primitive.

  1. Ubuntu Security Notices

  2. USN-8987-1

Publication date

3 November 2026

Overview

Several security issues were fixed in libuser.

Releases


16.04 LTS

Packages

  • libuser – user and group account administration library

Details

It was discovered that libuser did not properly validate the GECOS field
when changing user information. A local attacker could possibly use this
issue to corrupt the passwd file, resulting in a denial of service.
(CVE-2015-3245)

It was discovered that libuser modified the passwd file in place when
updating user information. A local attacker could possibly use this issue
to cause an inconsistent file state, resulting in a denial of service, or
possibly escalate privileges. (CVE-2015-3246)

It was discovered that libuser did not properly validate the GECOS field
when changing user information. A local attacker could possibly use this
issue to corrupt the passwd file, resulting in a denial of service.
(CVE-2015-3245)

It was discovered that libuser modified the passwd file in place when
updating user information. A local attacker could possibly use this issue
to cause an inconsistent file state, resulting in a denial of service, or
possibly escalate privileges. (CVE-2015-3246)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04 LTS xenial libuser1 –  1:0.60~dfsg-1.2ubuntu0.1~esm1

References

Häufig gestellte Fragen

What is CVE-2015-3245?
It is an input-validation flaw in libuser's GECOS-field handling: changing user information with crafted values could corrupt /etc/passwd, causing denial of service or account manipulation. CVE-2015-3246 is the related issue; both fixed in USN-8987-1 (CVSS 2.1 — local, low-impact severity).
Who is affected?
Systems using libuser's user-modification tools (luseradd, lpasswd and similar) with untrusted users able to invoke them — a narrow local surface.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade libuser; no service restart is needed for the library itself.
Why fix a CVE from 2015 now?
Old CVEs reach distribution packages when the flaw is re-discovered or a backport window opens — the year reflects discovery, not how long the fix took to matter. Apply per normal patching.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen