# Ubuntu releases security updates for libuser to address passwd file corruption

> **Key takeaway:** Security patches for libuser resolve vulnerabilities that could allow local attackers to corrupt the passwd file or escalate privileges.

**Published:** 2026-11-03T17:36:51+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-security-updates-for-libuser-to-address-pass.html 

## Summary
Ubuntu has issued a security notice (USN-8987-1) addressing two critical vulnerabilities found in the libuser library. This library is used for the administration of user and group accounts on Linux systems.

The vulnerabilities affect users of Ubuntu 16.04 LTS (Xenial) who utilize the libuser package for account management. The fixes are provided via the Ubuntu Pro ESM (Extended Security Maintenance) channel to ensure long-term stability for legacy systems.

## Vulnerability details and technical impact
- **GECOS Field Validation (CVE-2015-3245):** The library failed to properly validate the GECOS field during user information updates, which could allow a local attacker to corrupt the /etc/passwd file and cause a denial of service.
- **In-place File Modification (CVE-2015-3246):** libuser was found to modify the passwd file in place rather than using safer atomic operations, creating a risk of inconsistent file states.
- **Privilege Escalation Risk:** The inconsistent state caused by improper file modification could potentially be exploited by a local attacker to escalate their system privileges.
- **Affected Package Version:** The fix is specifically integrated into libuser1 version 1:0.60~dfsg-1.2ubuntu0.1~esm1 for the 16.04 LTS release.

## Why it matters
This update is critical for administrators running legacy Ubuntu 16.04 LTS environments who rely on Ubuntu Pro for security maintenance. It prevents local users from potentially destabilizing system authentication or gaining unauthorized root access through account management flaws.