Skip to content
OpenAdvisories
High 1 exploited CVE USN-8987-1 2 CVEs

libuser vulnerabilities

Published Nov 3, 2026 · Updated Nov 4, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libuser did not properly validate the GECOS field
when changing user information. A local attacker could possibly use this
issue to corrupt the passwd file, resulting in a denial of service.
(CVE-2015-3245)

It was discovered that libuser modified the passwd file in place when
updating user information. A local attacker could possibly use this issue
to cause an inconsistent file state, resulting in a denial of service, or
possibly escalate privileges. (CVE-2015-3246)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libuser 1:0.60~dfsg-1.2ubuntu0.1~esm1

Vulnerabilities 2

  • High 7.4
    CVE-2015-3246 Exploited Public exploit

    libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly mo…

    libuser libuser Debian Ubuntu
    KEV Aug 26, 2026
  • Unscored —
    CVE-2015-3245 Public exploit

    Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in …

    libuser libuser Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-3245
  • report
    https://ubuntu.com/security/CVE-2015-3246