Libuser Vulnerabilities — Ubuntu Security Update (USN-8987-1)

USN-8987-1 fixes two old libuser vulnerabilities on Ubuntu (CVE-2015-3245 and CVE-2015-3246): improper GECOS-field validation when changing user information could corrupt the passwd file (CWE-20), causing denial of service or account-manipulation issues. Update: sudo apt update && sudo apt upgrade libuser.

High 2.1 CVSS सक्रिय रूप से शोषित 2026-11-03

Ubuntu 20.04 Ubuntu 22.04

SharedLicense लाइसेंस के तहत इसका अर्थ

passwd-file corruption from the user-modification path can lock accounts out, break authentication, or be steered to manipulate account fields — a local denial-of-service and account-tampering primitive.

Ubuntu Security Notices
USN-8987-1

Publication date

3 November 2026

Overview

Several security issues were fixed in libuser.

Releases

16.04 LTS

Packages

libuser – user and group account administration library

Details

It was discovered that libuser did not properly validate the GECOS field
when changing user information. A local attacker could possibly use this
issue to corrupt the passwd file, resulting in a denial of service.
(CVE-2015-3245)

It was discovered that libuser modified the passwd file in place when
updating user information. A local attacker could possibly use this issue
to cause an inconsistent file state, resulting in a denial of service, or
possibly escalate privileges. (CVE-2015-3246)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
16.04 LTS xenial	libuser1 – 1:0.60~dfsg-1.2ubuntu0.1~esm1

References

अक्सर पूछे जाने वाले प्रश्न

What is CVE-2015-3245?

It is an input-validation flaw in libuser's GECOS-field handling: changing user information with crafted values could corrupt /etc/passwd, causing denial of service or account manipulation. CVE-2015-3246 is the related issue; both fixed in USN-8987-1 (CVSS 2.1 — local, low-impact severity).

Who is affected?

Systems using libuser's user-modification tools (luseradd, lpasswd and similar) with untrusted users able to invoke them — a narrow local surface.

How do I apply the fix?

Run sudo apt update && sudo apt upgrade libuser; no service restart is needed for the library itself.

Why fix a CVE from 2015 now?

Old CVEs reach distribution packages when the flaw is re-discovered or a backport window opens — the year reflects discovery, not how long the fix took to matter. Apply per normal patching.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें