USN-8987-1: Ubuntu patches two legacy libuser flaws on 16.04

Canonical released security advisory USN-8987-1 on 3 November 2026, addressing two vulnerabilities in the libuser package on Ubuntu 16.04 LTS (xenial). For those still managing servers on this release, understanding who actually receives the patch matters.

The two flaws

Both are CVEs from 2015, resurfaced during the latest Legacy maintenance cycle. The first: libuser did not properly validate the GECOS field when modifying user information. A local attacker could potentially exploit this to corrupt the passwd file, causing a denial of service (CVE-2015-3245).

The second concerns how the package writes changes: libuser modified the passwd file in-place during user information updates. A local attacker could potentially exploit this to cause an inconsistent file state, resulting in denial of service or potentially escalating privileges (CVE-2015-3246).

Who receives the patch and how

The fix applies to the libuser1 package, updated to version 1:0.60dfsg-1.2ubuntu0.1esm1 on Ubuntu 16.04 xenial. The ~esm1 suffix is not incidental: it indicates the update arrives only through the ESM channel, not through a standard apt upgrade on an unsubscribed system.

The reason lies in the support timeline. Ubuntu 16.04 exited standard ESM support in April 2026 and entered the Legacy phase, which covers years ten through fifteen of the lifecycle and extends until April 2031, as noted on the official release page. Without the Legacy add-on active on Ubuntu Pro, this patch — like future ones on 16.04 — will not arrive.

Administrators still running xenial machines can check their subscription status with sudo pro status --all and, if needed, contact Canonical to activate Legacy coverage. For those without urgent compatibility requirements, the simpler option remains on the table: plan a migration to a more recent release, since no direct upgrade path exists from 16.04 to the modern LTS versions.