Ubuntu libuser fixes passwd file corruption and local privilege escalation

Two serious PHP flaws could let an attacker run code without logging in. See which setups and PHP versions are affected ×

Several security issues were fixed in libuser. Software Description: - libuser: user and group account administration library Details: It was discovered that libuser did not properly validate the GECOS field when changing user information. A local attacker could possibly use this issue to corrupt the passwd file, resulting in a denial of service. (CVE-2015-3245) It was discovered that libuser modified the passwd file in place when updating user information. A local attacker could possibly use this issue to cause an inconsistent file state, resulting in a denial of service, or possibly escalate privileges. (CVE-2015-3246)

Several security issues were fixed in libuser.

Software Description:

- libuser: user and group account administration library

It was discovered that libuser did not properly validate the GECOS field

when changing user information. A local attacker could possibly use this

issue to corrupt the passwd file, resulting in a denial of service.

It was discovered that libuser modified the passwd file in place when

updating user information. A local attacker could possibly use this issue

to cause an inconsistent file state, resulting in a denial of service, or

possibly escalate privileges. (CVE-2015-3246)

The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS libuser1 1:0.60~dfsg-1.2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2015-3245, CVE-2015-3246

Ubuntu Security Notice USN-8987-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases